ColdFusion crossite scripting

User-Agent field from HTTP request is used unfiltered in error message text. It's possible to manipulate client's User-Agent field through Flash...

Adobe ColdFusion 67 - User_Agent Error Page Cross-Site Scripting

Adobe ColdFusion 67 - UserAgent Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/22401/info Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker could exploit this vulnerability to...

Adobe ColdFusion 6/7 - User_Agent Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/22401/info Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website...

CVE-2006-5858

Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...

CVE-2006-5858

CVE-2006-5858 affects Adobe ColdFusion MX 7–7.0.2 and JRun 4 when run on Microsoft IIS. The vulnerability allows remote attackers to read arbitrary files, list directories, or read source code by sending a double URL-encoded NULL byte in a ColdFusion filename (e.g., a .cfm file). This is a server...

iDefense Security Advisory 01.09.07: Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability

Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007 I. BACKGROUND Adobe Macromedia ColdFusion is an application server and development framework for websites. More information is...

Adobe Macromedia ColdFusion source code leak

Adding twice encoded NULL byte to path allows .CFM file content disclosure...

CVE-2006-5858

Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...

ColdFusion MX7信息泄露及跨站脚本漏洞

Macromedia ColdFusion MX是一个功能强大的商业性质的WEB应用服务器。 ColdFusion在处理用户请求时存在多个安全漏洞，远程攻击者可利用漏洞获得敏感信息。 远程攻击者向ColdFusion提交以下格式结束的无效请求，就会导致在返回结果中泄漏服务器路径： /.jws /.cfm /.cfml /.cfc 如果没有提供主机直接/CFIDE/administrator/login.cfm页面，就可以在href标签中获得服务器的内部IP地址。 此外，提交恶意的URL请求，可进行跨站脚本攻击。 Adobe ColdFusion MX 7.00...

ColdFusion MX7多个信息泄露及跨站脚本漏洞

ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion在处理用户请求时存在多个安全漏洞，远程攻击者可能利用这些漏洞获取服务器相关的敏感信息。 如果远程攻击者能够向ColdFusion提交以以下格式结束的无效请求的话，就会导致在返回结果中泄漏服务器路径： /.jws /.cfm /.cfml /.cfc...

CVE-2006-6482

Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request 1 for a non-existent a JWS, b CFM, c CFML, or d CFC file, which displays the installation path in the resulting error message; or 2 to /CFIDE/administrator/login.cfm without a host, which can reveal the...

CVE-2006-6483

Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting XSS attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte %00 in certain HTML tags, as demonstrated using "%00script" in a tag...

CVE-2006-6483

Affected software : Adobe ColdFusion MX 7.x before 7.0.2. Vulnerability : improper sanitization of HTML tags when mitigating XSS, allowing a NULL byte (%00) in certain tags to bypass filters and inject arbitrary web script or HTML. Impact : remote attacker could execute script in the context of t...

CVE-2006-6482

Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request 1 for a non-existent a JWS, b CFM, c CFML, or d CFC file, which displays the installation path in the resulting error message; or 2 to /CFIDE/administrator/login.cfm without a host, which can reveal the...

CVE-2006-6483

Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting XSS attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte %00 in certain HTML tags, as demonstrated using "%00script" in a tag...

CVE-2006-6482

CVE-2006-6482 affects Adobe ColdFusion MX7. The issue allows remote disclosure of sensitive information via URL requests: (1) requesting non-existent files (JWS, CFM, CFML, or CFC) causes error messages revealing the installation path; (2) accessing /CFIDE/administrator/login.cfm without a host c...

[Full-disclosure] [SBDA] - ColdFusion MX7 - Multiple Vulnerabilities

Just clearing stuff out before Christmas. ======================================================================== = ColdFusion MX7 - Multiple Vulnerabilities = = Vendor Website: = http://www.Adobe.com = = Affected Software: = ColdFusion MX7 and possibly MX6 = = Public disclosure on Monday Decemb...

coldfusionMX7.txt

Just clearing stuff out before Christmas. ======================================================================== = ColdFusion MX7 - Multiple Vulnerabilities = = Vendor Website: = http://www.Adobe.com = = Affected Software: = ColdFusion MX7 and possibly MX6 = = Public disclosure on Monday Decemb...

ColdFusion MX7 multiple security vulnerabilities

Information leak, crossite scripting protection bypass...

Adobe ColdFusion MX Verity库本地权限提升漏洞

ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion所安装的第三方Verity库存在多个输入验证错误，本地攻击者可以通过向该库发布特殊命令导致以本地系统权限运行这些命令。默认下这个库是以本地系统帐号运行的。 Adobe ColdFusion MX 7.02 Adobe ColdFusion MX 7.01 Adobe ColdFusion MX 7.00 临时解决方法：...