CVE-2021-43761

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-40722

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...

Cross site scripting

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

Cross site scripting

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a reflected Cross-Site Scripting XSS vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be...

Cross site scripting

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

Security feature bypass

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability...

Cross site scripting

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

Cross site scripting

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

Xxe

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...

Cross site scripting

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2021-43764 Adobe Experience Manager Stored XSS in the Spin Set

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2021-43764

CVE-2021-43764 affects Adobe Experience Manager (AEM) Cloud Service and on-premises 6.5.x up to 6.5.10.0, via a stored XSS in vulnerable form fields. Exploitation would execute malicious JavaScript in victims’ browsers when loading pages containing the vulnerable field. Mitigation: apply APSB21-1...

CVE-2021-44176

CVE-2021-44176 affects Adobe Experience Manager (AEM) Cloud Service and AEM 6.5.10.0 and earlier, with a stored XSS in the workflow Stages parameter (and related stored XSS in vulnerable form fields). The underlying issue allows an attacker to inject malicious JavaScript that can execute in a vic...

CVE-2021-43761 Adobe Experience Manager Stored XSS on Edit Tag page via Localization input

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-43761

CVE-2021-43761 affects Adobe Experience Manager (AEM) Cloud Service and on versions 6.5.7.0 and below, 6.4.8.3 and below, and 6.3.3.8 and below, via a stored XSS vulnerability that allows injected JavaScript in vulnerable form fields, potentially executing in a user’s browser when visiting the af...

CVE-2021-44177 Adobe Experience Manager Stored XSS in user name parameter in the package manager

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2021-44177

Adobe Experience Manager (AEM) CVE-2021-44177: A stored XSS vulnerability exists in AEM Cloud Service and in versions 6.5.10.0 and below, specifically in the user name parameter of the package manager. An attacker can inject malicious JavaScript into vulnerable form fields, which would be execute...

CVE-2021-40722

Adobe Experience Manager (AEM) – CVE-2021-40722 affects AEM Forms Cloud Service and on-prem 6.5.10.0 and earlier via an XML External Entity (XXE) injection that can lead to RCE. The connected advisories list this CVE as part of APSB21-103 and note remediation by upgrading to 6.5.11.0 or applying ...

CVE-2021-43765

Adobe Experience Manager (AEM) Cloud Service and on-prem versions 6.5.10.0 and earlier are affected by a stored XSS vulnerability in the Carousel/related form fields (CVE-2021-43765). An attacker can inject malicious JavaScript that executes in a victim’s browser when visiting a page containing t...

CVE-2021-44178

CVE-2021-44178 is a reflected XSS in Adobe Experience Manager (AEM)—affecting Cloud Service and versions 6.5.10.0 and below. The vulnerability occurs via the itemResourceType parameter, enabling malicious JavaScript to execute in a victim’s browser when they are lured to a vulnerable URL. Accordi...