CVE-2024-51963

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 3, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-519664.9There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticCVE-2024-51979.1There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align CVE-2024-519775.3An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP CVE-2024-519789.8An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An CVE-2024-519797.2An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 8CVE-2024-51983.3OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driveCVE-2024-519805.3An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to CVE-2024-519815.3An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to pCVE-2024-519827.5An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target devicCVE-2024-519837.5An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unCVE-2024-519846.8An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If CVE-2024-519875.4Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients creat