CVE-2024-34142

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-341449.8A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows CVE-2024-341458.8A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security CVE-2024-341466.5Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, a CVE-2024-341474.3Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins cont CVE-2024-341486.8Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is CVE-2024-341496.3In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2024-34154.8A vulnerability was found in SourceCodester Human Resource Information System 1.0. It has been classified as problematic. Affected is an unk CVE-2024-341524.3Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the CVE-2024-341537.8Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enabl CVE-2024-341554.3Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.CVE-2024-341567.5Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up t CVE-2024-341587.5Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.