Adobe: AEM forms XXE Vulnerability

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE. CVE: CVE-2021-40722 Ref: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html We...

CVE-2021-39159

BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input...

CVE-2021-39159

BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input...

CVE-2021-39159

BinderHub (a Kubernetes-based service for sharing reproducible environments) has a remote code execution vulnerability in affected versions that could let an attacker run code in the BinderHub context and exfiltrate deployment credentials (e.g., JupyterHub tokens, Kubernetes service accounts, and...

CVE-2021-28628

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2021-28628

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2021-28626

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by an Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service...

CVE-2021-28627

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interacti...

CVE-2021-28625

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2021-28625

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2021-28627

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interacti...

CVE-2021-28626

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by an Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service...

Cross site scripting

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

Authorization

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by an Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service...

Server side request forgery (ssrf)

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interacti...

CVE-2021-28627 Adobe Experience Manager Server-side Request Forgery could lead to Security feature bypass

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interacti...

CVE-2021-28627

CVE-2021-28627 affects Adobe Experience Manager Cloud Service and on-prem AEM 6.5.8.0 and below with a Server-Side Request Forgery (SSRF). An authenticated attacker could use SSRF to contact systems blocked by the dispatcher without user interaction. The issue is documented in APSB21-39; remediat...

CVE-2021-28628

CVE-2021-28628 is an XSS vulnerability affecting Adobe Experience Manager (AEM) Cloud Service and on-prem versions 6.5.8.0 and earlier, specifically in inbox render.jsp. The root cause is cross-site scripting via vulnerable form fields, allowing malicious JavaScript to run in a victim’s browser w...

CVE-2021-28625

CVE-2021-28625 is an XSS vulnerability in Adobe Experience Manager Cloud Service and On-Prem/Legacy 6.5.8.0 and earlier. The issue allows injection of malicious script into vulnerable form fields, leading to JavaScript execution in a victim’s browser when accessing the affected page. The connecte...

CVE-2021-28626

CVE-2021-28626 affects Adobe Experience Manager Cloud Service and older AEM 6.5.8.0 and below, via an Improper Authorization flaw that lets unauthenticated attackers create nodes under a location, potentially causing application denial-of-service. The issue does not require user interaction. Publ...