Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a 1 ColdFusion or 2 JavaScript component...

CVE-2014-2860

CVE-2014-2860 affects PaperThin CommonSpot prior to 7.0.2 and 8.x prior to 8.0.3. The vulnerability is a cross-site scripting (XSS) flaw that can be triggered via a crafted HTTP request to either a ColdFusion or JavaScript component, allowing remote attackers to inject arbitrary web script or HTM...

CVE-2014-2867

CVE-2014-2867 concerns PaperThin CommonSpot where an unrestricted file upload vulnerability could allow remote code execution by uploading a ColdFusion page. Affected versions are before 7.0.2 and 8.x before 8.0.3 ; vectors are not specified in the provided materials. The connected documents do n...

CVE-2014-2867

Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors...

CVE-2014-2868

CVE-2014-2868 affects PaperThin CommonSpot (before 7.0.2 and 8.x before 8.0.3). The issue allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable, as described in the CVE entries and Red Hat advisory references. Connecte...

Hardware Maker LaCie Admits Yearlong Data Breach

The French computer hardware company LaCie, perhaps best known for their external hard drives, announced this week it fell victim to a data breach that may have put at risk the sensitive information of anyone who has purchased a product off their website during the last year. According to an...

CVE-2014-2860: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a 1 ColdFusion or 2 JavaScript component...

PT-2014-4935

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to modify the flow of execution of ColdFusion code. This can be achieved by using an HTTP GET request t...

PT-2014-4927

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a ColdFusion or JavaScript...

CVE-2014-2867: Undefined Security Weakness

Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors...

CVE-2014-2868: Undefined Security Weakness

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable...

CVE-2014-2865: Undefined Security Weakness

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation...

ColdFusion Extended Support Version Detection (credentialed check)

According to its version, there is at least one installation of ColdFusion that is potentially under Extended Support. Note that the Extended Support program requires a vendor contract. Extended Support provides upgrades and security fixes for two years after regular support ends. C Tenable Netwo...

Adobe ColdFusion Unsupported Version Detection

According to its version, the installation of Adobe ColdFusion running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. %NASLMINLEVEL 70300...

ColdFusion Extended Support Version Detection

According to its version, there is at least one installation of ColdFusion on the remote host that is potentially under Extended Support. Note that the Extended Support program requires a vendor contract. Extended Support provides upgrades and security fixes for two years after regular support...

Adobe ColdFusion Unsupported Version Detection (credentialed check)

According to its version, the installation of Adobe ColdFusion running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network...

Adobe ColdFusion 9 Administrative Login Bypass Vulnerability

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Its password can by default or by misconfiguration be set to an empty value. This allows you to create a session via the RDS login that can be carried over to the admin web interfa...

Adobe ColdFusion 9 Administrative Login Bypass

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe ColdFusion 9 Administrative Login Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attacker...

Adobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe ColdFusion 9 Administrative Login Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attacker...

Adobe ColdFusion 9 Administrative Login Bypass

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to th...