Vulnerabilities in Esri

167 results
Vexday analysis

Com 150 CVEs catalogadas, o portfólio da Esri apresenta uma taxa de exploração ativa abaixo da média geral do catálogo KEV, sem nenhuma vulnerabilidade confirmada em uso por agentes de ameaça no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que indica exposição persistente a vetores de injeção de scripts em interfaces web. A CVE mais perigosa ativa no momento, CVE-2021-29097, registra um EPSS de 0,0241, sugerindo probabilidade relativamente baixa de exploração em curto prazo, embora as 7 vulnerabilidades de severidade crítica no total mereçam atenção contínua de equipes de gestão de patch. A ausência de PoCs públicas conhecidas reduz a superfície de risco imediato, mas não elimina a necessidade de monitoramento, especialmente diante das 4 CVEs registradas nos últimos 90 dias.

CVE-2024-25700MEDIUMPersistent XSS in URL added to a shared mapEPSS 0.4%CVE-2024-25696MEDIUMStored XSS in Portal for ArcGISEPSS 0.4%CVE-2024-25708MEDIUMPersistent XSS when creating new application using Web App BuilderEPSS 0.4%CVE-2024-25697MEDIUMStored XSS in Portal for ArcGISEPSS 0.4%CVE-2026-2812MEDIUMImproper Authentication issue in ArcGIS ServerEPSS 0.4%CVE-2025-67706MEDIUMUnvalidated File Upload vulnerability in ArcGIS Server.EPSS 0.4%CVE-2022-38200MEDIUMBUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.EPSS 0.3%CVE-2021-29112LOWEsri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2021-29118LOWEsri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-69228MEDIUMmissing authentication vulnerability in Esri Portal for ArcGISEPSS 0.3%CVE-2024-25707MEDIUMBUG-000160241 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2026-69224MEDIUMinformation disclosure vulnerability in Esri Portal for ArcGISEPSS 0.3%CVE-2026-69225MEDIUMinformation disclosure vulnerability in Esri Portal for ArcGISEPSS 0.3%CVE-2025-67712MEDIUMHTML injection issue in ArcGIS Web App BuilderEPSS 0.3%CVE-2023-25834MEDIUMBUG-000142922 Incomplete permission changes in specific cases.EPSS 0.3%CVE-2026-33519CRITICALIncorrect privilege assignment in Portal for ArcGISEPSS 0.3%CVE-2024-25691MEDIUMBUG-000165286 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2024-38038MEDIUMBUG-000165732 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2024-51954HIGHUnauthorized access to secure services in ArcGIS ServerEPSS 0.3%CVE-2024-8148MEDIUMBUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)EPSS 0.3%