CVE-2020-24445

CVE-2020-24445 affects Adobe Experience Manager (AEM) Cloud Service and on-prem versions up to 6.5.6.0, with a stored XSS in vulnerable form fields. Root cause: insufficient input handling that allows arbitrary JavaScript execution in the victim’s browser. Impact per sources: high confidentiality...

CVE-2021-40722

Adobe Experience Manager (AEM) – CVE-2021-40722 affects AEM Forms Cloud Service and on-prem 6.5.10.0 and earlier via an XML External Entity (XXE) injection that can lead to RCE. The connected advisories list this CVE as part of APSB21-103 and note remediation by upgrading to 6.5.11.0 or applying ...

CVE-2021-43762

CVE-2021-43762 affects Adobe Experience Manager (AEM) Cloud Service and on‑prem 6.5.10.0 and earlier, via a dispatcher bypass that could bypass security controls and expose sensitive areas of the web app. The issue is documented across multiple sources (NVD/NVDA, Nessus APSB21-103). Remediation i...

CVE-2021-43761

CVE-2021-43761 affects Adobe Experience Manager (AEM) Cloud Service and on versions 6.5.7.0 and below, 6.4.8.3 and below, and 6.3.3.8 and below, via a stored XSS vulnerability that allows injected JavaScript in vulnerable form fields, potentially executing in a user’s browser when visiting the af...

CVE-2021-44176

CVE-2021-44176 affects Adobe Experience Manager (AEM) Cloud Service and AEM 6.5.10.0 and earlier, with a stored XSS in the workflow Stages parameter (and related stored XSS in vulnerable form fields). The underlying issue allows an attacker to inject malicious JavaScript that can execute in a vic...

CVE-2021-44177

Adobe Experience Manager (AEM) CVE-2021-44177: A stored XSS vulnerability exists in AEM Cloud Service and in versions 6.5.10.0 and below, specifically in the user name parameter of the package manager. An attacker can inject malicious JavaScript into vulnerable form fields, which would be execute...

CVE-2021-21083

Adobe Experience Manager CVE-2021-21083 affects AEM Cloud Service and on-prem versions 6.5.7.0 and earlier, 6.4.8.3 and earlier, and 6.3.3.8 and earlier, due to an improper access control in the DSRPReindexServlet that can be exploited by an unauthenticated attacker to cause a denial-of-service i...

CVE-2021-43765

Adobe Experience Manager (AEM) Cloud Service and on-prem versions 6.5.10.0 and earlier are affected by a stored XSS vulnerability in the Carousel/related form fields (CVE-2021-43765). An attacker can inject malicious JavaScript that executes in a victim’s browser when visiting a page containing t...

CVE-2021-43764

CVE-2021-43764 affects Adobe Experience Manager (AEM) Cloud Service and on-premises 6.5.x up to 6.5.10.0, via a stored XSS in vulnerable form fields. Exploitation would execute malicious JavaScript in victims’ browsers when loading pages containing the vulnerable field. Mitigation: apply APSB21-1...

CVE-2021-44178

CVE-2021-44178 is a reflected XSS in Adobe Experience Manager (AEM)—affecting Cloud Service and versions 6.5.10.0 and below. The vulnerability occurs via the itemResourceType parameter, enabling malicious JavaScript to execute in a victim’s browser when they are lured to a vulnerable URL. Accordi...

CVE-2021-21084

CVE-2021-21084 covers a stored XSS vulnerability in Adobe Experience Manager (AEM). Affected are Cloud Service and on‑prem versions 6.5.7.0 and below, 6.4.8.3 and below, and 6.3.3.8 and below. The flaw affects the resource resolver factory and could allow an attacker to inject malicious JavaScrip...