CVE-2020-9743 | ByteOS Network

Vulnerability Details :

CVE-2020-9743

Assigner-adobe

Assigner Org ID-078d4453-3bcd-4900-85e6-15281da43538

Published At-10 Sep, 2020 | 16:36

Updated At-16 Sep, 2024 | 18:28

HTML injection in AEM's content editor component

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:10 Sep, 2020 | 16:36

Updated At:16 Sep, 2024 | 18:28

▼CVE Numbering Authority (CNA)

HTML injection in AEM's content editor component

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).

Affected Products

Vendor

Product

Experience Manager

Versions

Affected

From unspecified through 6.5.5.0 (custom)
From unspecified through 6.4.8.1 (custom)
From unspecified through 6.3.3.8 (custom)
From unspecified through 6.2 SP1-CFP20 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-20	Improper Input Validation (CWE-20)

Type: CWE

CWE ID: CWE-20

Description: Improper Input Validation (CWE-20)

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html	x_refsource_MISC

Hyperlink: https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html	x_refsource_MISC x_transferred

Hyperlink: https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@adobe.com

Published At:10 Sep, 2020 | 17:15

Updated At:14 Sep, 2021 | 17:30

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

>>experience_manager>>Versions from 6.3.0.0(inclusive) to 6.3.3.8(inclusive)

cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*

>>experience_manager>>Versions from 6.4.0.0(inclusive) to 6.4.8.1(inclusive)

cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*

>>experience_manager>>Versions from 6.5.0.0(inclusive) to 6.5.5.0(inclusive)

cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp1:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp10:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp11:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp12.1:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp13:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp14:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp15:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp16:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp17:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp18:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp19:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp2:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp20:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp3:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp4:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp5:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp6:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp7:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp8:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-20	Secondary	psirt@adobe.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-20

Type: Secondary

Source: psirt@adobe.com

References

Hyperlink	Source	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html	psirt@adobe.com	Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Source: psirt@adobe.com

Resource:

Vendor Advisory

Similar CVEs

19088Records found

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.5||HIGH

EPSS-2.40% / 84.45%

||

7 Day CHG~0.00%

Published-20 Oct, 2020 | 21:52

Updated-16 Sep, 2024 | 19:09

Blind stored XSS in Marketo Sales insight plugin for SalesForce

Marketo Sales Insight plugin version 1.4355 (and earlier) is affected by a blind stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Vendor-Adobe Inc.

Product-marketo_sales_insight Marketo

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-5.9||MEDIUM

EPSS-2.49% / 84.71%

||

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.23% / 78.32%

||

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.64% / 69.52%

||

7 Day CHG~0.00%

Published-22 Apr, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Analytics AppMeasurement for Flash Library before 4.0.1, when debugTracking is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-analytics_appmeasurement_for_flash_library n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.21%

||

7 Day CHG~0.00%

Published-18 Nov, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.26% / 78.61%

||

7 Day CHG~0.00%

Published-21 Apr, 2022 | 18:08

Updated-17 Sep, 2024 | 00:45

Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution

ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.

Vendor-Adobe Inc.

Product-acs_aem_commons Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-2.90% / 85.82%

||

7 Day CHG~0.00%

Published-18 Nov, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

Vendor-n/a HP Inc.Adobe Inc.

Product-xp7_command_view_advanced_edition coldfusion xp_p9000_command_view_advanced_edition livecycle_data_services n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.50% / 64.95%

||

7 Day CHG~0.00%

Published-12 May, 2022 | 18:59

Updated-16 Sep, 2024 | 17:54

ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution

ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-3.16% / 86.39%

||

7 Day CHG~0.00%

Published-15 Apr, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.97%

||

7 Day CHG~0.00%

Published-13 Jun, 2015 | 15:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in admin/home/homepage/search in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

Vendor-n/a Adobe Inc.

Product-connect n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.10% / 27.87%

||

7 Day CHG~0.00%

Published-13 May, 2025 | 20:32

Updated-19 May, 2025 | 20:29

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect versions 12.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Vendor-Adobe Inc.

Product-connect Adobe Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.64% / 69.71%

||

7 Day CHG~0.00%

Published-13 Jun, 2015 | 15:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-connect n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.59% / 80.89%

||

7 Day CHG~0.00%

Published-06 Sep, 2018 | 19:00

Updated-05 Aug, 2024 | 05:18

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.72% / 71.64%

||

7 Day CHG~0.00%

Published-18 Aug, 2009 | 22:00

Updated-07 Aug, 2024 | 05:27

Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-jrun n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.10% / 27.87%

||

7 Day CHG~0.00%

Published-13 May, 2025 | 20:32

Updated-19 May, 2025 | 20:29

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect versions 12.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Vendor-Adobe Inc.

Product-connect Adobe Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.02% / 76.30%

||

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager AEM 6.2 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.87%

||

7 Day CHG~0.00%

Published-26 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Help page in Adobe Acrobat 9.5.2 and earlier and ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion acrobat n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.02% / 76.30%

||

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Adobe Experience Manager versions 6.3 and earlier have an exploitable Cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager AEM 6.3 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.15% / 77.58%

||

7 Day CHG~0.00%

Published-28 Jan, 2019 | 18:00

Updated-05 Aug, 2024 | 11:44

Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager Forms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 70.34%

||

7 Day CHG~0.00%

Published-15 Oct, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.87%

||

7 Day CHG~0.00%

Published-17 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.97% / 75.73%

||

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0532.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.27% / 78.69%

||

7 Day CHG+0.12%

Published-05 Feb, 2009 | 01:00

Updated-07 Aug, 2024 | 11:20

Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver, when the Insert Flash Video feature is used, allows remote attackers to inject arbitrary web script or HTML via an asfunction: URI in the skinName parameter. NOTE: this may overlap CVE-2007-6242, CVE-2007-6244, or CVE-2007-6637.

Vendor-n/a Adobe Inc.

Product-dreamweaver n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.01% / 76.18%

||

7 Day CHG~0.00%

Published-17 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 10:10

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-9.79% / 92.66%

||

7 Day CHG~0.00%

Published-10 Nov, 2008 | 11:00

Updated-07 Aug, 2024 | 10:31

Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.

Vendor-n/a Adobe Inc.

Product-flash_player n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.15% / 77.58%

||

7 Day CHG~0.00%

Published-17 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 10:10

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-9.79% / 92.66%

||

7 Day CHG~0.00%

Published-10 Nov, 2008 | 11:00

Updated-07 Aug, 2024 | 10:31

Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving HTTP response headers.

Vendor-n/a Adobe Inc.

Product-flash_player n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.18% / 77.90%

||

7 Day CHG~0.00%

Published-18 Jul, 2019 | 21:49

Updated-04 Aug, 2024 | 21:02

Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.64% / 81.18%

||

7 Day CHG~0.00%

Published-25 Oct, 2019 | 14:57

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.64% / 81.18%

||

7 Day CHG~0.00%

Published-25 Oct, 2019 | 14:55

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.30% / 78.90%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:11

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to information disclosure.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.64% / 81.18%

||

7 Day CHG~0.00%

Published-22 Oct, 2019 | 20:50

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager_forms Adobe Experience Manager Forms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.01% / 76.19%

||

7 Day CHG~0.00%

Published-24 Oct, 2019 | 17:24

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.64% / 81.18%

||

7 Day CHG~0.00%

Published-24 Oct, 2019 | 17:22

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.01% / 76.23%

||

7 Day CHG~0.00%

Published-13 Aug, 2008 | 00:00

Updated-07 Aug, 2024 | 09:45

Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js, a different vulnerability than CVE-2008-3515.

Vendor-n/a Adobe Inc.

Product-presenter n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.01% / 76.23%

||

7 Day CHG~0.00%

Published-13 Aug, 2008 | 00:00

Updated-07 Aug, 2024 | 09:45

Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js, a different vulnerability than CVE-2008-3516.

Vendor-n/a Adobe Inc.

Product-presenter n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.57% / 80.78%

||

7 Day CHG~0.00%

Published-09 Jul, 2008 | 18:00

Updated-23 Apr, 2025 | 15:43

Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Help Errors log.

Vendor-n/a Adobe Inc.

Product-robohelp_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.80% / 85.54%

||

7 Day CHG~0.00%

Published-18 Jun, 2008 | 19:29

Updated-07 Aug, 2024 | 09:05

Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/. NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.

Vendor-n/a Adobe Inc.

Product-flex_builder flex n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-3.33% / 86.77%

||

7 Day CHG~0.00%

Published-12 Mar, 2008 | 00:00

Updated-07 Aug, 2024 | 08:17

Cross-site scripting (XSS) vulnerability in the web management interface in Adobe LiveCycle Workflow 6.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Vendor-n/a Adobe Inc.

Product-livecycle_workflow n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.69% / 70.89%

||

7 Day CHG~0.00%

Published-15 Jul, 2022 | 15:46

Updated-23 Apr, 2025 | 17:59

Adobe RoboHelp Reflected XSS could lead to Arbitrary code execution

Adobe RoboHelp versions 2020.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Vendor-Adobe Inc.

Product-robohelp RoboHelp

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-34.54% / 96.86%

||

7 Day CHG~0.00%

Published-04 Jan, 2008 | 00:00

Updated-07 Aug, 2024 | 16:11

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.

Vendor-n/a Adobe Inc.

Product-flash_player n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.27% / 78.63%

||

7 Day CHG~0.00%

Published-12 Nov, 2020 | 14:29

Updated-16 Sep, 2024 | 22:45

Reflected Cross-Site Scripting (XSS) in Adobe Connect

Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Vendor-Adobe Inc.

Product-connect Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-58.43% / 98.12%

||

7 Day CHG~0.00%

Published-20 Dec, 2007 | 01:00

Updated-07 Aug, 2024 | 16:02

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.

Vendor-n/a Adobe Inc.

Product-flash_player n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.32% / 79.05%

||

7 Day CHG~0.00%

Published-16 Oct, 2020 | 14:03

Updated-17 Sep, 2024 | 03:02

Stored XSS in customer address upload feature

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.

Vendor-magento Adobe Inc.

Product-magento Magento Commerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.27% / 78.66%

||

7 Day CHG~0.00%

Published-12 Nov, 2020 | 14:19

Updated-17 Sep, 2024 | 00:06

Reflected Cross-Site Scripting (XSS) in Adobe Connect

Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Vendor-Adobe Inc.

Product-connect Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.43% / 61.94%

||

7 Day CHG~0.00%

Published-26 Jun, 2020 | 20:21

Updated-04 Aug, 2024 | 10:34

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure .

Vendor-magento Adobe Inc.

Product-magento Magento

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-4.90% / 89.18%

||

7 Day CHG~0.00%

Published-12 Jun, 2020 | 13:12

Updated-04 Aug, 2024 | 10:34

Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.57% / 67.78%

||

7 Day CHG~0.00%

Published-22 Jul, 2020 | 19:23

Updated-04 Aug, 2024 | 10:34

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-magento Adobe Inc.

Product-magento Magento

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.23% / 78.35%

||

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Campaign versions 16.4 Build 8724 and earlier have a cross-site scripting (XSS) vulnerability.

Vendor-n/a Adobe Inc.

Product-campaign Adobe Campaign 16.4 Build 8724 and earlier.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.48% / 64.32%

||

7 Day CHG~0.00%

Published-27 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.

Vendor-n/a Adobe Inc.

Product-coldfusion Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')