Arcgis enterprise

This hub aggregates every CVE we track for Arcgis enterprise, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 13 most recently published vulnerabilities affecting Arcgis enterprise.

• CVE-2024-25699Portal for ArcGIS has an invalid authentication vulnerability8.5Apr 4, 2024
• CVE-2024-25708Persistent XSS when creating new application using Web App Builder4.8Apr 4, 2024
• CVE-2022-38211Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)7.5Dec 30, 2022
• CVE-2022-38206Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)6.1Dec 30, 2022
• CVE-2022-38204Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)6.1Dec 30, 2022
• CVE-2022-38210HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)6.1Dec 30, 2022
• CVE-2022-38208Unvalidated redirect in Portal for ArcGIS6.1Dec 30, 2022
• CVE-2022-38205Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)8.6Dec 30, 2022
• CVE-2022-38212Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)7.5Dec 30, 2022
• CVE-2022-38207Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)6.1Dec 30, 2022
• CVE-2021-29115An information disclosure vulnerability5.3Dec 7, 2021
• CVE-2021-3012A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTM...5.4Apr 8, 2021
• CVE-2019-16193In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature.5.4Sep 11, 2019