CVE-2018-19724

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Adobe	Adobe Experience Manager Forms	Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4

References

http://www.securityfocus.com/bid/106677Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/aem-forms/apsb19-03.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/106677Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/aem-forms/apsb19-03.htmlPatch, Vendor Advisory

Timeline

Published: Jan 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-197259.8Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a secu CVE-2018-197266.1Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation coul CVE-2018-197276.1Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation c CVE-2018-197286.5Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear CVE-2018-19737.2IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' l CVE-2018-19747.5IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. IBM CVE-2018-197487.5app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&r CVE-2018-197494.8DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.CVE-2018-19755.4IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allow CVE-2018-197505.4DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.CVE-2018-197514.8DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.CVE-2018-197524.8DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.