Adobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe ColdFusion 9 Administrative Login Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attacker...

Adobe ColdFusion 9 Administrative Login Bypass Vulnerability

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Its password can by default or by misconfiguration be set to an empty value. This allows you to create a session via the RDS login that can be carried over to the admin web interfa...

Adobe ColdFusion 9 Administrative Login Bypass

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to th...

Adobe ColdFusion scheduleedit.cfm Directory Traversal (CVE-2013-0629)

A directory traversal vulnerability has been reported in Adobe ColdFusion...

Adobe ColdFusion is vulnerable to cross-site scripting via the logviewer directory

Overview Adobe ColdFusion 10 update 11 and possibly earlier versions contain a reflected cross-site scripting XSS CWE-79 vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Adobe ColdFusion 10 update 11 and possibly earlier version...

Adobe ColdFusion Multiple Vulnerabilities (APSB13-27) (credentialed check)

The remote Windows host is running a version of ColdFusion that is affected by the following vulnerabilities : - A reflected cross-site scripting vulnerability exists because ColdFusion does not sanitize user-supplied input. This can be exploited by a remote, authenticated user when the CFIDE...

Security updates for available for Adobe Flash Player and ColdFusion vulnerabilities

Adobe released critical security patches for its ColdFusion web application server and Adobe Flash Player for Mac, Windows and Linux. Adobe AIR and the AIR SDK and Compiler are also being updated. These updates address vulnerabilities that could cause a crash and potentially allow an attacker to...

Security updates for available for Adobe Flash Player and ColdFusion vulnerabilities

None...

CVE-2013-5326

Cross-site scripting XSS vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory is available, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related ...

CVE-2013-5328

Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors...

Code injection

Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory is available, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related ...

CVE-2013-5326

Cross-site scripting XSS vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory is available, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related ...

CVE-2013-5328

Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2013-5328

CVE-2013-5328 affects Adobe ColdFusion 10 before Update 12. It allows remote attackers to read arbitrary files via unspecified vectors. Public sources (NVD, Red Hat, and CISA) corroborate the fixed behavior via Adobe APSB13-27; remediation is to apply the hotfix/update (Update 12) to ColdFusion 1...

CVE-2013-5326

Adobe ColdFusion versions 9.0 (before Update 12), 9.0.1 (before Update 11), 9.0.2 (before Update 6), and 10 (before Update 12) are vulnerable to a reflected cross-site scripting (XSS) flaw. The issue exists when the CFIDE directory is accessible, allowing remote authenticated users to inject arbi...

Adobe Releases Security Update for Adobe ColdFusion

Adobe has released a security hotfix for ColdFusion versions 10, 9.0.2, 9.0.1, and 9.0 for Windows, Macintosh and Linux to address multiple vulnerabilities. This hotfix addresses a reflected cross site scripting vulnerability CVE-2013-5326 that could be exploited by a remote, authenticated user a...

CVE-2013-5326: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory is available, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related ...

CVE-2013-5328: Undefined Security Weakness

Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors...

PT-2013-5486

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 9.0 through 9.0.2 before Update 6, and version 10 before Update 12 Adobe ColdFusion 9.0.1 before Update 11 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary w...