Esri

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-29097 1Esri 4Arcgis Engine Arcgis ProArcmap+1 more Jun 17, 2026 Mar 25, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to a...Show more Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.Show less
CVE-2021-29095 1Esri 1Arcgis Server Jun 17, 2026 Mar 25, 2021 N/A· v4 6.8 MEDIUM· v3 6.0 MEDIUM· v2 Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code exec...Show more Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.Show less
CVE-2021-29094 1Esri 1Arcgis Server Jun 17, 2026 Mar 25, 2021 N/A· v4 6.8 MEDIUM· v3 6.0 MEDIUM· v2 Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution...Show more Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.Show less
CVE-2021-29093 1Esri 1Arcgis Server Jun 17, 2026 Mar 25, 2021 N/A· v4 6.8 MEDIUM· v3 6.0 MEDIUM· v2 A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the con...Show more A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.Show less
CVE-2021-29096 1Esri 4Arcgis Engine Arcgis ProArcmap+1 more Jun 17, 2026 Mar 25, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve ar...Show more A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.Show less
CVE-2020-35712 1Esri 1Arcgis Server Jun 17, 2026 Dec 26, 2020 N/A· v4 9.8 CRITICAL· v3 9.3 HIGH· v2 Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.
CVE-2019-16193 1Esri 1Arcgis Enterprise Jun 17, 2026 Sep 11, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature.
CVE-2015-2002 1Esri 1Arcgisruntime Sdk Nov 21, 2024 Mar 29, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a n...Show more The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.Show less
CVE-2014-9741 1Esri 3Arcgis For Desktop Arcgis For EngineArcgis Server May 6, 2026 Jul 8, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified ve...Show more Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2014-5122 1Esri 1Arcgis Server May 6, 2026 Aug 22, 2014 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to login.
CVE-2014-5121 1Esri 1Arcgis Server May 6, 2026 Aug 22, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVE-2013-7232 1Esri 1Arcgis Server Apr 29, 2026 Dec 30, 2013 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.
CVE-2013-7231 1Esri 1Arcgis Server Apr 29, 2026 Dec 30, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different...Show more Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.Show less
CVE-2013-5222 1Esri 1Arcgis Server Apr 29, 2026 Dec 30, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-5221 1Esri 1Arcgis Server Apr 29, 2026 Sep 24, 2013 N/A· v4 N/A· v3 3.5 LOW· v2 The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.
CVE-2012-4949 1Esri 1Arcgis Server Apr 29, 2026 Nov 14, 2012 N/A· v4 N/A· v3 6.5 MEDIUM· v2 SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service.
CVE-2012-1661 1Esri 1Arcmap Apr 29, 2026 Jul 12, 2012 N/A· v4 N/A· v3 9.3 HIGH· v2 ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) fil...Show more ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.Show less
CVE-2007-4278 1Esri 1Arcsde Apr 23, 2026 Aug 15, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 Stack-based buffer overflow in the giomgr process in ESRI ArcSDE service 9.2, as used with ArcGIS, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number that...Show more Stack-based buffer overflow in the giomgr process in ESRI ArcSDE service 9.2, as used with ArcGIS, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number that requires more than 8 bytes to represent in ASCII, which triggers the overflow in an sprintf function call.Show less
CVE-2007-1770 1Esri 1Arcsde Apr 23, 2026 Mar 30, 2007 N/A· v4 N/A· v3 10.0 HIGH· v2 Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial...Show more Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service (giomgr crash) and execute arbitrary code via long parameters in crafted requests.Show less
CVE-2006-0089 1Esri 1Arcpad Apr 16, 2026 Jan 5, 2006 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute.

Previous 1...6 7 8910 Next