CVE-2024-26086
published 2024-06-13CVE-2024-26086: Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a…
PriorityP425medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.68%
48.5th percentile
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_experience_manager | <= 6.5.20 | — |
| adobe | experience_manager | < 6.5.21 | 6.5.21 |
| adobe | experience_manager | < 2024.5 | 2024.5 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cisa5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6rvr-w68p-86fc: Adobe Experience Manager versions 6
ghsa_unreviewed·2024-06-13
CVE-2024-26086 [MEDIUM] CWE-79 GHSA-6rvr-w68p-86fc: Adobe Experience Manager versions 6
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CISA
Atlassian Jira Server and Data Center Path Traversal Vulnerability
cisa·2024-11-12·CVSS 5.3
CVE-2021-26086 [MEDIUM] CWE-22 Atlassian Jira Server and Data Center Path Traversal Vulnerability
Vulnerability: Atlassian Jira Server and Data Center Path Traversal Vulnerability
Affected: Atlassian Jira Server and Data Center
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://jira.atlassian.com/browse/JRASERVER-72695 ; https://nvd.nist.gov/vuln/detail/CVE-2021-26086
Remediation Due Date: 2024-12-03
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-13
Published