Threat Intelligence Database

An information disclosure vulnerability exists in Esri Portal for ArcGIS versions 12.0 and earlier. Under difficult to reproduce conditions, a remote, unauthenticated attacker may be able to cause sensitive information to be reflected in an HTTP response body. The vulnerability has a moderate severity score and does not require authentication for exploitation. No known exploits are reported in the wild, and no patch or remediation information is currently available.

A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and earlier. This flaw allows a remote attacker with administrative privileges to inject malicious scripts that could execute in the browsers of other users. The vulnerability affects versions including 11.1, 11.3, and 11.5. Users are advised to upgrade to the latest long-term support release to mitigate the risk.

A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior. This vulnerability may allow a remote, privileged attacker to inject malicious JavaScript code that executes in the context of other users' browsers. The issue affects versions including 11.1, 11.3, and 11.5. Users are advised to patch or upgrade to the latest long-term support release to mitigate this risk.

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and earlier. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, may execute arbitrary JavaScript in the victim's browser. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release. Additionally, users of ArcGIS Web App Builder developer edition should migrate to ArcGIS Experience Builder as the former is unsupported for this vulnerability.

A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior. This vulnerability allows a remote, privileged attacker to inject malicious code that may execute in the browser of a victim. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are specifically advised to apply patches or upgrade to the latest long-term support release to mitigate this issue.

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.