CVSS: 6.8EPSS: 0%CPEs: 24EXPL: 0CVE-2020-9737 – Stored XSS in AEM's Content Repository Development Environment
https://notcve.org/view.php?id=CVE-2020-9737
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field. Las versiones de AEM 6.5.5.0 (y anteriores), 6.4.8.1 (y anteriores), 6.3.3.8 (y anteriores) y 6.2 SP1-CFP20 (y posteriores), están afectadas por una vulnerabilidad de tipo XSS almacenado que permite a usuarios acceder al Content Repository Development Environment para almacenar scripts maliciosos en determinados campos de nodos. Estos scripts pueden ser ejecutados en el navegador de la víctima cuando abren la página que contiene el campo vulnerable • https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-9733 – Sensitive information disclosure possible in AEM
https://notcve.org/view.php?id=CVE-2020-9733
An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository. Un servlet java de AEM en AEM versiones 6.5.5.0 (y anteriores) y versiones 6.4.8.1 (y anteriores) se ejecuta con los permisos de un usuario de servicio muy privilegiado. Si es explotado, esto podría conllevar a un acceso de solo lectura a datos confidenciales en un repositorio de AEM • https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 0%CPEs: 24EXPL: 0CVE-2020-9740 – Stored XSS in AEM Design Importer Component
https://notcve.org/view.php?id=CVE-2020-9740
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Design Importer. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field. Las versiones de AEM 6.5.5.0 (y anteriores), 6.4.8.1 (y anteriores), 6.3.3.8 (y anteriores) y 6.2 SP1-CFP20 (y posteriores) están afectadas por una vulnerabilidad de tipo XSS almacenado que permite a usuarios con privilegios de "Author" almacenar scripts maliciosos en campos asociados con Design Importer. Estos scripts pueden ser ejecutados en el navegador de la víctima cuando abre la página que contiene el campo vulnerable • https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-9651
https://notcve.org/view.php?id=CVE-2020-9651
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser. Adobe Experience Manager versiones 6.5 y anteriores, presentan una vulnerabilidad de tipo cross-site scripting (reflejado). Una explotación con éxito podría conllevar a una ejecución de javascript arbitraria en el navegador • https://helpx.adobe.com/security/products/experience-manager/apsb20-31.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-9647
https://notcve.org/view.php?id=CVE-2020-9647
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser. Adobe Experience Manager versiones 6.5 y anteriores, presentan una vulnerabilidad de tipo cross-site scripting (basada en dom). Una explotación con éxito podría conllevar a una ejecución de javascript arbitraria en el navegador • https://helpx.adobe.com/security/products/experience-manager/apsb20-31.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •