Multiple vulnerabilities in Adobe Experience Manager

1) Stored cross-site scripting

EUVDB-ID: #VU91933

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36195

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stored cross-site scripting

EUVDB-ID: #VU91927

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36189

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Stored cross-site scripting

EUVDB-ID: #VU91928

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36190

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stored cross-site scripting

EUVDB-ID: #VU91929

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36191

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Stored cross-site scripting

EUVDB-ID: #VU91930

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36192

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Stored cross-site scripting

EUVDB-ID: #VU91931

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36193

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Stored cross-site scripting

EUVDB-ID: #VU91932

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36194

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Stored cross-site scripting

EUVDB-ID: #VU91934

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36196

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Stored cross-site scripting

EUVDB-ID: #VU91925

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36187

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Stored cross-site scripting

EUVDB-ID: #VU91935

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36197

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Stored cross-site scripting

EUVDB-ID: #VU91936

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36198

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Stored cross-site scripting

EUVDB-ID: #VU91937

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36199

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Stored cross-site scripting

EUVDB-ID: #VU91938

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36200

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Stored cross-site scripting

EUVDB-ID: #VU91939

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36201

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Stored cross-site scripting

EUVDB-ID: #VU91940

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36202

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Stored cross-site scripting

EUVDB-ID: #VU91926

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36188

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Stored cross-site scripting

EUVDB-ID: #VU91924

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36186

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Stored cross-site scripting

EUVDB-ID: #VU91942

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36204

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Stored cross-site scripting

EUVDB-ID: #VU91915

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36177

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Stored cross-site scripting

EUVDB-ID: #VU91909

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36171

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Stored cross-site scripting

EUVDB-ID: #VU91910

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36172

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Stored cross-site scripting

EUVDB-ID: #VU91911

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36173

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Stored cross-site scripting

EUVDB-ID: #VU91912

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36174

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Stored cross-site scripting

EUVDB-ID: #VU91913

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36175

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Stored cross-site scripting

EUVDB-ID: #VU91914

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36176

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Stored cross-site scripting

EUVDB-ID: #VU91916

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36178

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Stored cross-site scripting

EUVDB-ID: #VU91923

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36185

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Stored cross-site scripting

EUVDB-ID: #VU91917

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36179

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Stored cross-site scripting

EUVDB-ID: #VU91918

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36180

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Stored cross-site scripting

EUVDB-ID: #VU91919

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36181

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Stored cross-site scripting

EUVDB-ID: #VU91920

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36182

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Stored cross-site scripting

EUVDB-ID: #VU91921

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36183

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Stored cross-site scripting

EUVDB-ID: #VU91922

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36184

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Stored cross-site scripting

EUVDB-ID: #VU91941

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36203

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Stored cross-site scripting

EUVDB-ID: #VU91943

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36205

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Stored cross-site scripting

EUVDB-ID: #VU91907

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36169

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Stored cross-site scripting

EUVDB-ID: #VU91969

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36232

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Stored cross-site scripting

EUVDB-ID: #VU91963

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36225

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Stored cross-site scripting

EUVDB-ID: #VU91964

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36227

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Stored cross-site scripting

EUVDB-ID: #VU91965

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36228

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Stored cross-site scripting

EUVDB-ID: #VU91966

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36229

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Stored cross-site scripting

EUVDB-ID: #VU91967

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36230

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Stored cross-site scripting

EUVDB-ID: #VU91968

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36231

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Stored cross-site scripting

EUVDB-ID: #VU91970

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36233

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Stored cross-site scripting

EUVDB-ID: #VU91961

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36223

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Stored cross-site scripting

EUVDB-ID: #VU91971

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36234

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Stored cross-site scripting

EUVDB-ID: #VU91972

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36235

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Stored cross-site scripting

EUVDB-ID: #VU91973

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36236

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Stored cross-site scripting

EUVDB-ID: #VU91974

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36238

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Stored cross-site scripting

EUVDB-ID: #VU91975

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36239

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Input validation error

EUVDB-ID: #VU91978

Risk: Low

CVSSv3.1: 3.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36226

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can bypass implemented security restrictions.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Stored cross-site scripting

EUVDB-ID: #VU91962

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36224

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Stored cross-site scripting

EUVDB-ID: #VU91960

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36222

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Stored cross-site scripting

EUVDB-ID: #VU91944

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36206

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Stored cross-site scripting

EUVDB-ID: #VU91951

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36213

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Stored cross-site scripting

EUVDB-ID: #VU91945

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36207

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Stored cross-site scripting

EUVDB-ID: #VU91946

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36208

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Stored cross-site scripting

EUVDB-ID: #VU91947

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36209

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Stored cross-site scripting

EUVDB-ID: #VU91948

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36210

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Stored cross-site scripting

EUVDB-ID: #VU91949

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36211

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Stored cross-site scripting

EUVDB-ID: #VU91950

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36212

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Stored cross-site scripting

EUVDB-ID: #VU91952

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36214

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Stored cross-site scripting

EUVDB-ID: #VU91959

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36221

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Stored cross-site scripting

EUVDB-ID: #VU91953

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36215

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Stored cross-site scripting

EUVDB-ID: #VU91954

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36216

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Stored cross-site scripting

EUVDB-ID: #VU91955

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36217

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Stored cross-site scripting

EUVDB-ID: #VU91956

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36218

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Stored cross-site scripting

EUVDB-ID: #VU91957

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36219

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Stored cross-site scripting

EUVDB-ID: #VU91958

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36220

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Stored cross-site scripting

EUVDB-ID: #VU91908

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36170

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Stored cross-site scripting

EUVDB-ID: #VU91906

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36168

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Improper access control

EUVDB-ID: #VU91836

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26029

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Stored cross-site scripting

EUVDB-ID: #VU91860

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26092

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Stored cross-site scripting

EUVDB-ID: #VU91854

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26083

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Stored cross-site scripting

EUVDB-ID: #VU91855

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26085

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Stored cross-site scripting

EUVDB-ID: #VU91856

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26088

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Stored cross-site scripting

EUVDB-ID: #VU91857

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26089

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Stored cross-site scripting

EUVDB-ID: #VU91858

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26090

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Stored cross-site scripting

EUVDB-ID: #VU91859

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26091

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Stored cross-site scripting

EUVDB-ID: #VU91861

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26093

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Stored cross-site scripting

EUVDB-ID: #VU91852

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26081

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Stored cross-site scripting

EUVDB-ID: #VU91862

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26095

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Stored cross-site scripting

EUVDB-ID: #VU91863

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26110

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Stored cross-site scripting

EUVDB-ID: #VU91864

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26111

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Stored cross-site scripting

EUVDB-ID: #VU91865

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26113

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Stored cross-site scripting

EUVDB-ID: #VU91866

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26114

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Stored cross-site scripting

EUVDB-ID: #VU91867

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26115

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Stored cross-site scripting

EUVDB-ID: #VU91853

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26082

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Stored cross-site scripting

EUVDB-ID: #VU91851

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26078

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Stored cross-site scripting

EUVDB-ID: #VU91869

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26117

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Stored cross-site scripting

EUVDB-ID: #VU91842

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26058

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Stored cross-site scripting

EUVDB-ID: #VU91837

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26036

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Stored cross-site scripting

EUVDB-ID: #VU91838

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26037

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Stored cross-site scripting

EUVDB-ID: #VU91839

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26039

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Stored cross-site scripting

EUVDB-ID: #VU91976

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26049

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Stored cross-site scripting

EUVDB-ID: #VU91840

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26053

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Stored cross-site scripting

EUVDB-ID: #VU91841

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26057

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Stored cross-site scripting

EUVDB-ID: #VU91843

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26066

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Stored cross-site scripting

EUVDB-ID: #VU91850

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26077

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Stored cross-site scripting

EUVDB-ID: #VU91844

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26068

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Stored cross-site scripting

EUVDB-ID: #VU91845

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26070

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Stored cross-site scripting

EUVDB-ID: #VU91846

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26071

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Stored cross-site scripting

EUVDB-ID: #VU91847

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26072

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Stored cross-site scripting

EUVDB-ID: #VU91848

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26074

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Stored cross-site scripting

EUVDB-ID: #VU91849

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26075

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Stored cross-site scripting

EUVDB-ID: #VU91868

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26116

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Stored cross-site scripting

EUVDB-ID: #VU91870

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26121

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Stored cross-site scripting

EUVDB-ID: #VU91905

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36167

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Stored cross-site scripting

EUVDB-ID: #VU91897

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36159

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Stored cross-site scripting

EUVDB-ID: #VU91891

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36153

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Stored cross-site scripting

EUVDB-ID: #VU91892

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36154

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Stored cross-site scripting

EUVDB-ID: #VU91893

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36155

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Stored cross-site scripting

EUVDB-ID: #VU91894

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36156

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Stored cross-site scripting

EUVDB-ID: #VU91895

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36157

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Stored cross-site scripting

EUVDB-ID: #VU91896

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36158

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Stored cross-site scripting

EUVDB-ID: #VU91898

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36160

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Stored cross-site scripting

EUVDB-ID: #VU91889

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36151

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Stored cross-site scripting

EUVDB-ID: #VU91899

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36161

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Stored cross-site scripting

EUVDB-ID: #VU91900

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36162

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Stored cross-site scripting

EUVDB-ID: #VU91901

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36163

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Stored cross-site scripting

EUVDB-ID: #VU91902

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36164

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Stored cross-site scripting

EUVDB-ID: #VU91903

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36165

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Stored cross-site scripting

EUVDB-ID: #VU91904

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36166

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Stored cross-site scripting

EUVDB-ID: #VU91890

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36152

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) Stored cross-site scripting

EUVDB-ID: #VU91888

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36150

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Stored cross-site scripting

EUVDB-ID: #VU91871

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26123

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Stored cross-site scripting

EUVDB-ID: #VU91878

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-34119

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Stored cross-site scripting

EUVDB-ID: #VU91872

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-20769

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Stored cross-site scripting

EUVDB-ID: #VU91873

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-20784

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Stored cross-site scripting

EUVDB-ID: #VU91874

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26054

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Stored cross-site scripting

EUVDB-ID: #VU91875

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26055

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Stored cross-site scripting

EUVDB-ID: #VU91876

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26060

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) Stored cross-site scripting

EUVDB-ID: #VU91877

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26086

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Stored cross-site scripting

EUVDB-ID: #VU91879

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-34120

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.2-SP1-CFP15 - 6.5.20.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.2-SP1-CFP15:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.2:*:*:*:*:*:*:
• cpe:2.3:a:adobe:adobe_experience_manager:6.3:*:*:*:*:*:*:

http://helpx.adobe.com/security/products/experience-manager/apsb24-28.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?