Adobe Experience Manager: 108 records in one advisory

What this batch was researched, not held

Adobe kept adding identifiers to this June 2024 bulletin until November

APSB24-28 was published on 11 June 2024 at priority 3 for Adobe Experience Manager, and then it grew six times. Adobe added CVE-2024-34141 and CVE-2024-34142 on 19 June, updated dependencies on 25 June, added CVE-2024-34128 and CVE-2024-41839 on 22 July, added eleven more identifiers on 20 August, added CVE-2024-45153 on 2 October, and added CVE-2024-49523 and CVE-2024-49524 on 7 November. That is why the records citing this one bulletin were published to the CVE list across five months. The table now carries 164 identifiers. Its acknowledgements credit 159 of them to just three people: Jim Green, who reports under the handle green-jam, with 98; Lorenzo Pirondini with 55; and Akshay Sharma, who reports as anonymous_blackzero, with 6. The classes are nearly uniform, at 156 stored cross-site scripting entries, 5 improper input validation entries and 1 improper access control entry.

If the record you are reading has a publication date well after June 2024, that is the day Adobe added it to an existing bulletin, not the day of a new release. The bulletin's revision list names which identifiers arrived on which date, so the arrival can be checked. The other records pointing at this bulletin are separate entries with their own credits.

The revision list says what was added and when, and says nothing about why any of it arrived months late. The bulletin gives no component or page for any identifier. It also repeats one identical severity vector across the stored scripting entries, so the score cannot be used to tell two of them apart.

Written from web.archive.org, tenable.com, helpx.adobe.com. Reviewed for whether every claim traces to one of them, by two independent graders, citation support 4.44 of 5, uniqueness 4 of 5. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.