CVE-2024-52854
published 2024-12-10CVE-2024-52854: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…
medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_experience_manager | <= 6.5.21 | — |
| adobe | experience_manager | < 6.5.22.0 | 6.5.22.0 |
| adobe | experience_manager | < 2024.11.0 | 2024.11.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv7.8HIGH
OSV
linux-iot vulnerabilities
osv·2025-12-04·CVSS 7.8
CVE-2025-40300 linux-iot vulnerabilities
linux-iot vulnerabilities
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to expose sensitive information from the host OS. (CVE-2025-40300)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- HSI subsystem;
- I3C subsystem;
- SMB network file system;
- Padata parallel execution mechanism;
- Timer subsystem;
- Networking core;
(CVE-2023-52854, CVE-2024-35867, CVE-2024-50061, CVE-2024-56664,
CVE-2025-21727, CVE-2025-3
OSV
linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities
osv·2025-11-19·CVSS 7.8
CVE-2025-40300 linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities
linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to expose sensitive information from the host OS. (CVE-2025-40300)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- HSI subsystem;
- I3C subsystem;
- SMB network file system;
- Padata parallel execution mechanism;
- Timer subsystem;
- Networking core;
(CVE-2023-52854, CVE-2024-35867, CVE-2024-50061, CVE-2024-
GHSA
GHSA-pjxq-jpr4-67xp: Adobe Experience Manager versions 6
ghsa_unreviewed·2024-12-11
CVE-2024-52854 [MEDIUM] CWE-79 GHSA-pjxq-jpr4-67xp: Adobe Experience Manager versions 6
Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-10
Published