http-coldfusion-subzero NSE Script

Attempts to retrieve version, absolute path of administration panel and the file 'password.properties' from vulnerable installations of ColdFusion 9 and 10. This was based on the exploit 'ColdSub-Zero.pyFusion v2'. See also: http-adobe-coldfusion-apsa1301.nse http-vuln-cve2009-3960.nse...

Adobe ColdFusion Information Disclosure Vulnerability (APSB13-13)

Adobe ColdFusion is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Patch Zero Day Used to Attack Deptartment of Labor

Microsoft will ship 10 bulletins in the May edition of Patch Tuesday. The company considers just two of the patches critical, one of which supplements the currently available “Fix it” tool that resolved the IE zero-day vulnerability exploited recently in a watering-hole attack targeting the U.S...

CVE-2013-3336

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors...

Code injection

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors...

Adobe to Patch Critical Flaw in ColdFusion

Adobe is readying a patch for a critical vulnerability in its ColdFusion Web application server that is being used in attacks right now. The vulnerability affects several versions of ColdFusion running on Windows, Unix and OS X. The flaw, which Adobe plans to patch on May 14, can be used by a...

CVE-2013-3336

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors...

CVE-2013-3336

Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10 are vulnerable to a directory traversal vulnerability caused by a design weakness. A remote attacker can exploit this issue to retrieve arbitrary files from the target system, such as password hashes and

Adobe Releases Security Update for ColdFusion

Adobe has released a security hotfix for ColdFusion 10, 9.0.2, 9.0.1, and 9.0 for Windows, Macintosh, and UNIX. This hotfix addresses a vulnerability CVE-2013-1389 that could allow a remote attacker to execute arbitrary code and a vulnerability CVE-2013-3336 that could permit an unauthorized user...

CVE-2013-3336: Undefined Security Weakness

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors...

PT-2013-4299

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 9.0 through 9.0.2 Adobe ColdFusion version 10 Description The issue allows remote attackers to read arbitrary files. Recommendations For Adobe ColdFusion versions 9.0 through 9.0.2, update to a version that is not...

ColdFusion 9-10 - Credential Disclosure

ColdFusion 9-10 - Credential Disclosure !/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m" red = "\x1b1;31m"...

ColdFusion 9-10 - Credential Disclosure

!/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m" red = "\x1b1;31m" clear = "\x1b0m" print...

ColdFusion 9 / 10 Remote Root Exploit

ColdFusion version 9 and 10 remote root zero day exploit !/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m"...

ColdFusion 9 / 10 Remote Root

!/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m" red = "\x1b1;31m" clear = "\x1b0m" print...

ColdFusion 'password.properties' Hash Extraction

This module uses a directory traversal vulnerability to extract information such as password, rdspassword, and "encrypted" properties. This module has been tested successfully on ColdFusion 9 and ColdFusion 10 auto-detect. Module Options msf use auxiliary/gather/coldfusion/pwdprops msf...

Coldfusion 9.0.1 信息泄露漏洞

No description provided by source...

Adobe ColdFusion security vulnerabilities

Information leakage, unauthorized access...

Linode Hacked Through ColdFusion Zero Day

The attackers who compromised Web hosting provider Linode used a zero day vulnerability in Adobe ColdFusion and were able to access the company’s database, source code and customers’ credit card numbers and passwords. The company said that the customer credit card numbers were encrypted, as were...

Adobe ColdFusion Multiple Vulnerabilities (APSB13-10) (credentialed check)

The remote Windows host is running a version of ColdFusion that is affected by the following vulnerabilities : - An unspecified user impersonation vulnerability. CVE-2013-1387 - An unspecified vulnerability that allows unauthorized access to the administrator console. CVE-2013-1388 C Tenable...