CVE-2016-4264

The Office Open XML OOXML feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity...

Patched ColdFusion Flaw Exposes Applications to Attack

An Adobe ColdFusion vulnerability addressed Tuesday in a hotfix pushed to users put applications developed on the platform at risk to a number of serious issues. Researcher Dawid Golunski of Legal Hackers today revealed details on the flaw, which he privately disclosed to Adobe, as well as a...

PT-2016-2687

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 through 10 before Update 21 Adobe ColdFusion versions 11 through 11 before Update 10 Description The issue is related to an XML External Entity XXE problem in the Office Open XML OOXML feature, allowing remote...

CVE-2016-4264: Improper Restriction of XML External Entity Reference

The Office Open XML OOXML feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2016-07016)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An information disclosure vulnerability exists in Adobe ColdFusion 11 Update 9 and earlier and ColdFusion 10...

Adobe ColdFusion 'XML External Entity' Information Disclosure Vulnerability (APSB16-30)

Adobe ColdFusion is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe ColdFusion XML External Entity (XXE) Injection Information Disclosure (APSB16-30)

The version of Adobe ColdFusion running on the remote Windows host is missing a security hotfix. It is, therefore, affected by an XML External Entity XXE injection vulnerability due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. An unauthenticate...

Adobe Releases Security Updates for ColdFusion

Adobe has released security updates to address a vulnerability in ColdFusion. Exploitation of this vulnerability may allow a remote attacker to obtain sensitive information from an affected system. Users and administrators are encouraged to review Adobe Security Bulletin APSB16-30 and apply the...

APSB16-30 Security update available for ColdFusion

Adobe has released security hotfixes for ColdFusion versions 10 and 11. These hotfixes resolve a critical vulnerability that could lead to information disclosure CVE-2016-4264...

Adobe ColdFusion Unspecified Reflected XSS (APSB16-22)

The version of Adobe ColdFusion running on the remote Windows host is missing a security hotfix. It is, therefore, affected by a reflected cross-site scripting XSS vulnerability due to a failure to properly sanitize user-supplied input. An unauthenticated, remote attacker, using a crafted request...

CVE-2016-4159

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-4159

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-4159

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-4159

CVE-2016-4159 is a cross-site scripting (XSS) vulnerability affecting Adobe ColdFusion 10 prior to Update 20, ColdFusion 11 prior to Update 9, and ColdFusion 2016 prior to Update 2. The issue is described in the connected sources as a reflected XSS due to input validation failures, allowing an un...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2016-04109)

Adobe ColdFusion is a dynamic Web server product that runs CFML, a programming language for Web applications. A cross-site scripting vulnerability exists in Adobe ColdFusion, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

PT-2016-5855

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 before Update 20 Adobe ColdFusion versions 11 before Update 9 Adobe ColdFusion versions 2016 before Update 2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HT...

CVE-2016-4159: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Adobe ColdFusion Security Update (APSB16-22)

Adobe ColdFusion is prone to a reflected cross site scripting vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fix Coming for Flash Vulnerability Under Attack

Adobe today said it will patch Flash Player this week, addressing a vulnerability being exploited in “limited, targeted attacks.” The flaw, CVE-2016-4171, exists in versions of Flash prior to, and including, 21.0.0.242 on Windows, Macintosh, Linux and ChromeOS platforms. “Successful exploitation...