CVE-2017-11283: Deserialization of Untrusted Data

Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...

CVE-2017-11285: Improper Neutralization of Input During Web Page Generation

Adobe ColdFusion has a cross-site scripting XSS vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...

CVE-2017-11284: Deserialization of Untrusted Data

Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...

CVE-2017-11286: Improper Restriction of XML External Entity Reference

Adobe ColdFusion has an XML external entity XXE injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...

PT-2017-11890

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to Update 5 for ColdFusion 2016 Adobe ColdFusion versions prior to Update 13 for ColdFusion 11 Description The issue is related to Untrusted Data Deserialization. Recommendations For Adobe ColdFusion 2016, updat...

PT-2017-11891

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to Update 5 for ColdFusion 2016 Adobe ColdFusion versions prior to Update 13 for ColdFusion 11 Description The issue is related to a cross-site scripting XSS problem. Recommendations For Adobe ColdFusion 2016,...

PT-2017-11892

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to Update 5 for ColdFusion 2016 Adobe ColdFusion versions prior to Update 13 for ColdFusion 11 Description The issue is related to an XML external entity XXE injection. This type of injection occurs when an...

Adobe ColdFusion DataServicesCFProxy Insecure Deserialization (CVE-2017-11283)

An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation by the DataServicesCFProxy. A successful attack could lead to a remote code execution...

Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)

An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation on objects in the RMI Registry before deserializing them. A remote, unauthenticated attacker can exploit this vulnerability by sending...

Mura CMS < 6.2 - Server-Side Request Forgery / XML External Entity Injection Vulnerabilities

Exploit for unknown platform in category web applications Exploit Title: Mura CMS before 6.2 SSRF + XXE Date: 30-10-2017 Exploit Author: Anthony Cole Vendor Homepage: http://www.getmura.com/ Version: before 6.2 Contact: http://twitter.com/acole76 Website: http://twitter.com/acole76 Tested on:...

Adobe ColdFusion arbitrary command execution flaws vulnerability 0day(CVE–2017–11283, CVE–2017–11284)early warning-vulnerability warning-the black bar safety net

Adobe ColdFusion in 2017 9 November 12 released a network security update in refer to the previous version, there is a serious deserialization flaws vulnerability bug（CVE-2017-11283, CVE-2017-11284, and may incur long-distance code to fulfill. When applying the Flex integration-do on Remote Adobe...

Adobe ColdFusion Deserialization RCE (CVE-2017-11283, CVE-2017-11238)

During my research into the Java Remote Method Invocation RMI protocol, the most common RMI service that I came across was Adobe ColdFusion’s Flex integration service which is used to support integration between Flash applications and ColdFusion components. A quick look at this service led to the...

clusterd - Application Server Attack Toolkit

clusterd is an open source application server attack toolkit. Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. See the wiki for more information. Requiremen...

Adobe ColdFusion Multiple Vulnerabilities (APSB17-30)

Adobe ColdFusion is prone to information disclosure and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2017-32687)

Adobe ColdFusion is a dynamic Web server product that runs CFML which is a programming language for Web applications. Adobe ColdFusion fails to properly restrict references to XML external entities, allowing remote attackers to exploit vulnerabilities to submit special requests, obtain sensitive...

Adobe ColdFusion APSB17-30 Remote Command Execution Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. A security vulnerability exists in Adobe ColdFusion 2016 release Update 4 and earlier and ColdFusion 11 Upda...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2017-32686)

Adobe ColdFusion is a dynamic Web server product that runs CFML which is a programming language for Web applications. A cross-site scripting vulnerability exists in Adobe ColdFusion, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be...

Adobe ColdFusion APSB17-30 Remote Command Execution Vulnerability (CNVD-2017-30530)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. A security vulnerability exists in Adobe ColdFusion 2016 release Update 4 and earlier and ColdFusion 11 Upda...

Adobe ColdFusion 11.x < 11u13 / 2016.x < 2016u5 Multiple Vulnerabilities (APSB17-30)

The version of Adobe ColdFusion running on the remote Windows host is 11.x prior to update 13 or 2016.x prior to update 5. It is, therefore, affected by multiple vulnerabilities : - A Java deserialization flaw exists that allows an unauthenticated, remote attacker to execute arbitrary code...

Adobe Patches Two Critical RCE Vulnerabilities in Flash Player

Adobe may kill Flash Player by the end of 2020, but until then, the company would not stop providing security updates to the buggy software. As part of its monthly security updates, Adobe has released patches for eight security vulnerabilities in its three products, including two vulnerabilities ...