CVE-2024-38037

BUG-000167983 - Unvalidated redirect in Portal for ArcGIS

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2024-38036

BUG-000154827 - Reflected XSS in ArcGIS Experience Builder

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2024-25708

Persistent XSS when creating new application using Web App Builder

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Microsoft

Products

Arcgis Enterprise Windows

CVE-2024-25706

HTMLi at createFolder Content Injection

There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2024-25697

Stored XSS in Portal for ArcGIS

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser.  The privileges required to execute this attack are low.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2024-25696

Stored XSS in Portal for ArcGIS

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack are high.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Arcgis Esri

Products

Portal Portal For Arcgis

CVE-2024-25695

concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2024-25692

BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS

There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated attacker to trick an authorized user into executing unwanted actions via a crafted form. The impact to Confidentiality and Integrity vectors is limited and of low severity.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Portal For Arcgis Linux Kernel Windows

CVE-2023-25841

BUG-000158075 Stored XSS issue in ArcGIS Server

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Kernel Windows

CVE-2023-25840

BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Kernel Windows

CVE-2022-4417

WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cerber

Products

Wp Cerber Security\, Anti-spam \& Malware Scan

CVE-2022-4373

Quote-O-Matic <= 1.0.5 - Admin+ SQLi

The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Quote-o-matic Project

Products

Quote-o-matic

CVE-2022-4369

WP-Lister Lite for Amazon < 2.4.4 - Reflected XSS

The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wplite

Products

Wp-lister Lite For Amazon

CVE-2022-4360

WP RSS By Publishers <= 0.1 - Admin+ SQLi

The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Wp Rss By Publishers Project

Products

Wp Rss By Publishers

CVE-2022-4357

LetsRecover < 1.2.0 - Unauthenticated SQLi

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Letsrecover Project

Products

Letsrecover

CVE-2022-4356

LetsRecover < 1.2.0 - Admin+ SQLi

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Letsrecover Project

Products

Letsrecover

CVE-2022-4355

LetsRecover < 1.2.0 - Admin+ SQLi

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Letsrecover Project

Products

Letsrecover

CVE-2022-4352

Qe SEO Handyman <= 1.0 - Admin+ SQLi

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Qe Seo Handyman Project

Products

Qe Seo Handyman

CVE-2022-4340

BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id

The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Reputeinfosystems

Products

Bookingpress

CVE-2022-4324

Custom Field Template < 2.5.8 - Admin+ PHP Object Injection

The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

CVSS 3.1 · 7.2 High EPSS 17.7% KEV · Not listed

Vendors

Wpgogo

Products

Custom Field Template