RSS   Vulnerabilities for 'Arcgis'   RSS

2013-12-29
 
CVE-2013-7232

CWE-89
 

 
SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.

 
 
CVE-2013-7231

CWE-79
 

 
Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.

 
 
CVE-2013-5222

CWE-79
 

 
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

 
2013-09-24
 
CVE-2013-5221

CWE-20
 

 
The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.

 
2012-11-14
 
CVE-2012-4949

 

 
SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service.

 
2012-07-12
 
CVE-2012-1661

 

 
ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.

 
2007-08-15
 
CVE-2007-4278

CWE-119
 

 
Stack-based buffer overflow in the giomgr process in ESRI ArcSDE service 9.2, as used with ArcGIS, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number that requires more than 8 bytes to represent in ASCII, which triggers the overflow in an sprintf function call.

 
2007-03-29
 
CVE-2007-1770

 

 
Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service (giomgr crash) and execute arbitrary code via long parameters in crafted requests.

 
2005-05-03
 
CVE-2005-1394

 

 
Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environment variable to (1) wservice or (2) lockmgr.

 

 >>> Vendor: ESRI 7 Products
Arcinfo workstation
Arcgis
Arcpad
Arcmap
Arcgis for server
Arcgis for desktop
Arcgis for engine


Copyright 2017, cxsecurity.com

 

Back to Top