Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure

Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure source: https://www.securityfocus.com/bid/4882/info Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program tha...

CVE-2001-1514

ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to 1 child processes created with and 2 child processes that call the CreateProcess function and are executed with or end with the CFX extension...

CVE-1999-1124

HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host...

ColdFusion Denial of Service vulnerability in sample script

Subject: ColdFusion Denial of Service vulnerability in sample script Software: ColdFusion Server Professional 4.5.1 Eval for Windows SP2 Risk Level: Medium Author: Niels Heinen Vendor Status: The vendor has released a document concerning this problem Exploitable: Remotely Impact of the...

CVE-2000-0538

ColdFusion Administrator for ColdFusion 4.5.1 and earlier allows remote attackers to cause a denial of service via a long login password...

CVE-2000-0382

ColdFusion ClusterCATS appends stale query string arguments to a URL during HTML redirection, which may provide sensitive information to the redirected site...

ColdFusion Server 2.0/3.x/4.x - Administrator Login Password Denial of Service

source: https://www.securityfocus.com/bid/1314/info Due to a faulty mechanism in the password parsing implementation in authentication requests, it is possible to launch a denial of service attack against Allaire ColdFusion 4.5.1 or previous by inputting a string of over 40 000 characters to the...

New Allaire ColdFusion DoS

Foundstone, Inc. http://www.foundstone.com "Securing the Dot Com World" Security Advisory Allaire's ColdFusion ---------------------------------------------------------------------------- --------- FS Advisory ID: FS-060700-1-CFM Release Date: June 7, 2000 Product: ColdFusion Web Application Serv...

CVE-1999-0477

The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly...

CVE-1999-0455

The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly...

ms.odbc.coldfusion.txt

Date: Tue, 1 Jun 1999 11:45:35 -0700 From: [email protected] To: [email protected] Subject: New Allaire Security Bulletin ASB99-09 Dear Allaire Customer -- We have recently become aware of a serious security vulnerability that may affect customers using Microsoft Access with ColdFusion...

Allaire ColdFusion Server 4.0 - Remote File Display / Deletion / Upload / Execution

source: https://www.securityfocus.com/bid/115/info To display and delete any file on the system use an URL of the following form: http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file To upload files to the sever first find out the location of the sample code on the...

Allaire ColdFusion Server 4.0.1 - CFCRYPT.EXE Decrypt Pages

Allaire ColdFusion Server 4.0.1 - CFCRYPT.EXE Decrypt Pages / source: https://www.securityfocus.com/bid/275/info A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted. ColdFusion supports the ability to "encrypt" the CFML templates in an application or...