CVE-2022-30680

Adobe Experience Manager (AEM) 6.5.13.0 and earlier is affected by a reflected XSS vulnerability (CVE-2022-30680). The issue allows executing malicious JavaScript in a victim’s browser when a user visits a crafted URL referencing a vulnerable page; exploitation requires low-privilege access. The ...

CVE-2022-30685 AEM Reflected XSS Arbitrary code execution

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

CVE-2022-30685

CVE-2022-30685 affects Adobe Experience Manager 6.5.13.0 and earlier, with a reflected XSS vulnerability that allows malicious JavaScript to run in a victim’s browser when a user visits a crafted URL. Exploitation requires low privileges and some user interaction. Connected sources indicate this ...

CVE-2022-30683 AEM Violation of Secure Design Principles Security feature bypass

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a Violation of Secure Design Principles vulnerability that could lead to bypass the security feature of the encryption mechanism in the backend . An attacker could leverage this vulnerability to decrypt secrets, however, this i...

CVE-2022-30683

CVE-2022-30683 affects Adobe Experience Manager 6.5.13.0 and earlier. It is a Violation of Secure Design Principles that could bypass the backend encryption feature and allow decryption of secrets. Exploitation requires low privileges and the attacker to already possess those secrets; the attack ...

GHSA-QCGC-6Q86-7X2P AEM WCM Core Components CVG Image vulnerable to Reflected Cross-site Scripting

Core Components version 2.20.6 and earlier suffer from a reflected cross-site scripting XSS vulnerability in AdaptiveImageServlet via SVG images. An attacker with author access can upload a special crafted SVG image including a malicious Javascript and obtain a link that, when loaded by another...

AEM WCM Core Components CVG Image vulnerable to Reflected Cross-site Scripting

Core Components version 2.20.6 and earlier suffer from a reflected cross-site scripting XSS vulnerability in AdaptiveImageServlet via SVG images. An attacker with author access can upload a special crafted SVG image including a malicious Javascript and obtain a link that, when loaded by another...

CVE-2022-35697 AEM File Upload Security Issue leading to RXSS

Adobe Experience Manager Core Components version 2.20.6 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

Malicious code in sfdc-aem-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e730d8656ba56075221c46c0267a587f2f6c60648a4455dc9079ca7fee30dd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6046 Malicious code in sfdc-aem-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e730d8656ba56075221c46c0267a587f2f6c60648a4455dc9079ca7fee30dd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

acs-aem-commons is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script via the a and b GET parameters in page compare when a victim with access to AEM Author visits the page...

Page Compare Reflected Cross-site Scripting (XSS) vulnerability

Impact ACS Commons version 5.1.x and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitized. An attacker must provide a...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ACS Commons version 5.1.x and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to...

Adobe Acs-aem-commons cross-site scripting vulnerability

Adobe Acs-aem-commons is a Java-based codebase of AEM/CQ code collections generated from AEM by Adobe U.S. Adobe Acs-aem-commons 5.1.x and earlier versions contain a cross-site scripting vulnerability that could be exploited by an attacker to inject malicious JavaScript content into vulnerable fo...

CVE-2022-28820

ACS Commons version 5.1.x and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to...

Cross site scripting

ACS Commons version 5.1.x and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to...

CVE-2022-28820

ACS Commons 5.1.x and earlier are affected by a Reflected Cross-site Scripting (XSS) in the /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input is not validated or sanitized, enabling an attacker who can supply a link to a user with AEM Author access to...

CVE-2022-28820 Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution

ACS Commons version 5.1.x and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to...

Adobe Acs-aem-commons 跨站脚本漏洞

Adobe Acs-aem-commons is a Java-based codebase of AEM/CQ code collections generated from AEM by Adobe U.S. Adobe Acs-aem-commons 5.1.x and earlier versions contain a cross-site scripting vulnerability that could be exploited by an attacker to inject malicious JavaScript content into vulnerable fo...

CVE-2021-44178

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a reflected Cross-Site Scripting XSS vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be...