Cross-Site Scripting Vulnerabilities in ESRI ArcGIS Products
CVE-2014-9741

Currently unrated

Key Information:

Vendor

Esri

Status
Arcgis For Engine
Arcgis For Server
Arcgis For Desktop
Vendor
CVE Published:
8 July 2015

What is CVE-2014-9741?

Multiple cross-site scripting (XSS) vulnerabilities exist in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server versions up to 10.2.2. These vulnerabilities enable remote attackers to inject arbitrary web scripts or HTML through unspecified vectors, potentially leading to unauthorized actions and data compromise. It is crucial for organizations using these products to apply the necessary security patches to mitigate these risks.

References

http://blogs.esri.com/esri/arcgis/2014/09/04/arcgis-for-s...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1032733
vdb-entryx_refsource_SECTRACK
http://support.esri.com/en/downloads/patches-servicepacks...
x_refsource_CONFIRM

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.