# Adobe Experience Manager Cloud Service


- [CVE-2021-40722](https://insights.sbomify.com/CVE-2021-40722/): AEM Forms Improper Restriction of XML External Entity Reference (critical 9.8)
- [CVE-2020-24445](https://insights.sbomify.com/CVE-2020-24445/): Cross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM) (critical 9.0)
- [CVE-2021-43765](https://insights.sbomify.com/CVE-2021-43765/): Adobe Experience Manager Stored XSS in the Carousel Set (high 8.1)
- [CVE-2021-44176](https://insights.sbomify.com/CVE-2021-44176/): Adobe Experience Manager Stored XSS in workflow Stages parameter (high 8.1)
- [CVE-2021-44177](https://insights.sbomify.com/CVE-2021-44177/): Adobe Experience Manager Stored XSS in user name parameter in the package manager (high 8.1)
- [CVE-2021-43761](https://insights.sbomify.com/CVE-2021-43761/): Adobe Experience Manager Stored XSS on Edit Tag page via Localization input (high 8.0)
- [CVE-2021-43764](https://insights.sbomify.com/CVE-2021-43764/): Adobe Experience Manager Stored XSS in the Spin Set (high 8.0)
- [CVE-2021-21083](https://insights.sbomify.com/CVE-2021-21083/): Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-service (high 7.5)
- [CVE-2021-21084](https://insights.sbomify.com/CVE-2021-21084/): Cross-site scripting in Experience Manager (high 7.3)
- [CVE-2021-43762](https://insights.sbomify.com/CVE-2021-43762/): Adobe Experience Manager Unicode normalization leads to dispatcher bypass (medium 6.5)
- [CVE-2023-48444](https://insights.sbomify.com/CVE-2023-48444/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48445](https://insights.sbomify.com/CVE-2023-48445/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/products/adobe/experience-manager-cloud-service/