CVE-2021-44176

CVE-2021-44176 affects Adobe Experience Manager (AEM) Cloud Service and AEM 6.5.10.0 and earlier, with a stored XSS in the workflow Stages parameter (and related stored XSS in vulnerable form fields). The underlying issue allows an attacker to inject malicious JavaScript that can execute in a vic...

CVE-2021-43761

CVE-2021-43761 affects Adobe Experience Manager (AEM) Cloud Service and on versions 6.5.7.0 and below, 6.4.8.3 and below, and 6.3.3.8 and below, via a stored XSS vulnerability that allows injected JavaScript in vulnerable form fields, potentially executing in a user’s browser when visiting the af...

CVE-2021-44177

Adobe Experience Manager (AEM) CVE-2021-44177: A stored XSS vulnerability exists in AEM Cloud Service and in versions 6.5.10.0 and below, specifically in the user name parameter of the package manager. An attacker can inject malicious JavaScript into vulnerable form fields, which would be execute...

CVE-2021-40722 AEM Forms Improper Restriction of XML External Entity Reference

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...

CVE-2021-40722

Adobe Experience Manager (AEM) – CVE-2021-40722 affects AEM Forms Cloud Service and on-prem 6.5.10.0 and earlier via an XML External Entity (XXE) injection that can lead to RCE. The connected advisories list this CVE as part of APSB21-103 and note remediation by upgrading to 6.5.11.0 or applying ...

CVE-2021-43765

Adobe Experience Manager (AEM) Cloud Service and on-prem versions 6.5.10.0 and earlier are affected by a stored XSS vulnerability in the Carousel/related form fields (CVE-2021-43765). An attacker can inject malicious JavaScript that executes in a victim’s browser when visiting a page containing t...

CVE-2021-44178

CVE-2021-44178 is a reflected XSS in Adobe Experience Manager (AEM)—affecting Cloud Service and versions 6.5.10.0 and below. The vulnerability occurs via the itemResourceType parameter, enabling malicious JavaScript to execute in a victim’s browser when they are lured to a vulnerable URL. Accordi...

CVE-2021-43762

CVE-2021-43762 affects Adobe Experience Manager (AEM) Cloud Service and on‑prem 6.5.10.0 and earlier, via a dispatcher bypass that could bypass security controls and expose sensitive areas of the web app. The issue is documented across multiple sources (NVD/NVDA, Nessus APSB21-103). Remediation i...

CVE-2021-44176

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2021-43764

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2021-44178

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a reflected Cross-Site Scripting XSS vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be...

Adobe: AEM forms XXE Vulnerability

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE. CVE: CVE-2021-40722 Ref: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html We...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21083

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

Improper access control

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

Cross site scripting

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084

CVE-2021-21084 covers a stored XSS vulnerability in Adobe Experience Manager (AEM). Affected are Cloud Service and on‑prem versions 6.5.7.0 and below, 6.4.8.3 and below, and 6.3.3.8 and below. The flaw affects the resource resolver factory and could allow an attacker to inject malicious JavaScrip...

CVE-2021-21083

Adobe Experience Manager CVE-2021-21083 affects AEM Cloud Service and on-prem versions 6.5.7.0 and earlier, 6.4.8.3 and earlier, and 6.3.3.8 and earlier, due to an improper access control in the DSRPReindexServlet that can be exploited by an unauthenticated attacker to cause a denial-of-service i...

Cross-Site Scripting (XSS)

acs-aem-commons-ui.apps is vulnerable to Cross-Site Scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser due to insecure handling of invalid JCR characters...