Known vulnerabilities in ArcGIS

Vendor: ESRI
Software: ArcGIS
Software CPE: cpe:2.3:a:esri:arcgis:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 28
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ArcGIS ArcGIS is affected by 28 known vulnerabilities: 5 high, 1 medium, 22 low Critical High Medium Low

Vulnerabilities (28)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU106307 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-51958		 CWE-22 Low
No
No
 11.2 31.03.2025 SB2025062811
#VU106291 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51947		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106292 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51948		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106293 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51950		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106294 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51957		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106295 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51951		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106296 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51963		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106297 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51942		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106298 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51960		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106299 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51946		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106300 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-10904		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106301 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51953		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106302 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51944		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106303 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51945		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106304 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-5888		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106305 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51952		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106306 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51956		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU106290 - Improper Authentication
CVE-2025-2538		 CWE-287 High
No
No
 2025 Update 1 Patch 31.03.2025 SB2025033167
#VU106289 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-51949		 CWE-79 Low
No
No
 11.3 31.03.2025 SB2025062812
#VU51789 - Stack-based buffer overflow
CVE-2021-29097		 CWE-121 High
No
No
 - 30.03.2021 SB2021033018


Showing elements 1 - 20 out of 28