CVE-2021-28625

CVE-2021-28625 is an XSS vulnerability in Adobe Experience Manager Cloud Service and On-Prem/Legacy 6.5.8.0 and earlier. The issue allows injection of malicious script into vulnerable form fields, leading to JavaScript execution in a victim’s browser when accessing the affected page. The connecte...

CVE-2021-28626

CVE-2021-28626 affects Adobe Experience Manager Cloud Service and older AEM 6.5.8.0 and below, via an Improper Authorization flaw that lets unauthenticated attackers create nodes under a location, potentially causing application denial-of-service. The issue does not require user interaction. Publ...

CVE-2021-28628: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2021-28625: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2021-28627: Server-Side Request Forgery (SSRF)

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interacti...

CVE-2021-28626: Improper Authorization

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by an Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service...

PT-2021-24125

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Cloud Service Appliance EPM CSA affected versions not specified Description: A code injection vulnerability in the Ivanti EPM Cloud Services Appliance CSA allows an unauthenticated user to execute arbitrary code with...

DoD Cloud Computing Impact Levels 4-5

Moving past DoD Impact Level 2 IL2, the logical next step should be IL3; however, IL3 is no longer used by the Department of Defense DoD and has been consolidated into IL4. DoD IL4 is designed to store, process, and transmit up to controlled unclassified information CUI related to military or...

[ADM Cloud] License information is missing on ADM Cloud Service and all managed ADCs enter graceful period

Licenses are missing like below on ADM Cloud Service: And managed ADCs enter graceful period due to no license activation...

Weak Password Vulnerability in TopGate500 of Skyrun Technology Group

Founded in 1995 as the first network security enterprise in China, Skyrun Technology Group has become a leading network security, big data and cloud service provider in China. A weak password vulnerability exists in TopGate500 of Tianrongxin Technology Group, which allows an attacker to log in to...

Requirements for DoD Impact Level 2

As discussed in the previous blog post on FedRAMP+, there are four authorization levels defined in the Department of Defense DoD Cloud Computing CC Security Requirements Guide SRG. In this post we will give a brief rundown of the lowest authorization level, DoD Impact Level IL 2, and the security...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21083

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

Cross site scripting

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

Improper access control

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

CVE-2021-21084 Adobe Experience Manager stored cross-site scripting vulnerability in resource resolver factory could lead to arbitrary code execution

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084

CVE-2021-21084 covers a stored XSS vulnerability in Adobe Experience Manager (AEM). Affected are Cloud Service and on‑prem versions 6.5.7.0 and below, 6.4.8.3 and below, and 6.3.3.8 and below. The flaw affects the resource resolver factory and could allow an attacker to inject malicious JavaScrip...

CVE-2021-21083

Adobe Experience Manager CVE-2021-21083 affects AEM Cloud Service and on-prem versions 6.5.7.0 and earlier, 6.4.8.3 and earlier, and 6.3.3.8 and earlier, due to an improper access control in the DSRPReindexServlet that can be exploited by an unauthenticated attacker to cause a denial-of-service i...