CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-33651
https://notcve.org/view.php?id=CVE-2023-33651
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules. • https://blog.assetnote.io/2023/05/10/sitecore-round-two https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925 • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22264 – AEM URL Redirection to Untrusted Site Security feature bypass
https://notcve.org/view.php?id=CVE-2023-22264
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction. • https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22266 – AEM URL Redirection to Untrusted Site Security feature bypass
https://notcve.org/view.php?id=CVE-2023-22266
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction. • https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22254 – AEM Reflected XSS Arbitrary code execution
https://notcve.org/view.php?id=CVE-2023-22254
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. • https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22265 – AEM URL Redirection to Untrusted Site Security feature bypass
https://notcve.org/view.php?id=CVE-2023-22265
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction. • https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •