The fact, that the JSON file is 9MB in size has 2 implications:The download time from the CDN (in which compressing the JSON can help),but also the parsing of that JSON on the client device; and this time is not improved by compressing the the file.I recommend you to test the performance of your app...

How did you find those vulnerabilities? Were you just scanning your application or were you scaning the uber.jar file of AEM? Or even scanning the AEM instance itself (or SDK)? In any way, I would check with Adobe support.

Hi, When you look at this request: https://www.test.com/page.html?utm_source=abc&utm_medium=xzy&utm_campaign=123&utm_content=something what does your browser do? It will send this request to the backed and retrieve the HTML markup for page.html; it will download all referenced files, including image...

What configuration parameter do you want to add per tenant?

That approach is not compatible with AEM CS. May I ask why you try to achieve this?

Do you want to track the download of the PDF itself?* In this case you can augment the link which points to the PDF.* But of course that does not work if the enduser downloads the PDF without using this link, but during an non-augmented link (or if the PDF is attached to a email). Can you elaborate ...

I would assume that the vhost with the hostname "flush" does either not exist or has not configured the invalidation correctly.

If you are using AEM 6.x (and not AEM CS), you can use the Ensure Oak Index feature of ACS AEM Commons.

CWE-99 is described here (Mitre) as Insufficient input check:  The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. I assume that you re...

With this configuration you can just define the name of the HTTP header, which is copied over from the request the user made to the dispatcher into the request the dispatcher makes to AEM. You cannot add custom headers with specific values into the request to AEM with this configuration parameter.