Cross site scripting

Cross-site scripting XSS vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2010-1293

Cross-site scripting XSS vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-1294

Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors...

CVE-2009-3467

Cross-site scripting XSS vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2009-3467

CVE-2009-3467 affects Adobe ColdFusion 8.0, 8.0.1, and 9.0, with an unspecified method vulnerability enabling cross-site scripting that lets an attacker inject arbitrary script via unknown vectors. Public details indicate risk is tied to XSS in the ColdFusion server; the exact exploit vectors are...

CVE-2010-1293

Adobe ColdFusion CVE-2010-1293 is an XSS vulnerability affecting the Admin page in ColdFusion 8.0, 8.0.1, and 9.0. The issue arises from improper sanitization in the administrative interface, notably input to cfadminUserId on /CFIDE/administrator/login.cfm when Separate user name and password aut...

CVE-2010-1294

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2009-3467: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2010-1294: Exposure of Sensitive Information to an Unauthorized Actor

Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors...

CVE-2010-1293: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Preemptive Protection against Adobe ColdFusion Multiple Cross-Site Scripting Vulnerabilities (APSB10-11)

Multiple cross-site scripting XSS vulnerabilities have been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. Cross-site scripting occurs when a Web-based application fails to validate user input before returning it to...

Adobe Patches 'Critical' Shockwave, ColdFusion holes

Adobe joined the Patch Tuesday train today with the release of patches for at least 21 documented security vulnerabilities in the Shockwave and ColdFusion product lines. According to the APSB10-12 security bulletin, 18 of the 21 flaws affected the Shockwave Player, a free software product that le...

cfm local include exploit-vulnerability warning-the black bar safety net

1.读取metabase.xml/web.xml /password. properities sensitive files,know the www path,coldfusion,coldfusion backend encrypted password ! 2. Local contains the coldfusion logs,write cfm in a word,get a WEBSHELL...

Multiple Adobe Products XML External Entity (XXE) Injection (APSB10-05)

The remote host appears to be running an Adobe product that is susceptible to XML External Entity XXE attacks. The installed version of the product fails to block the use of external XML entities while using the HTTPChannel to transport data in AMFX format. A remote, unauthenticated attacker coul...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

CVE-2009-3960

CVE-2009-3960 is an information-disclosure vulnerability in Adobe BlazeDS and related Adobe data services components (e.g., LiveCycle, ColdFusion) where XML External Entity/XML Injection flaws can allow remote attackers to obtain sensitive information. Root cause: injected tags and external entit...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

PT-2010-1185

Name of the Vulnerable Software and Affected Versions BlazeDS versions 3.2 and earlier LiveCycle versions 8.0.1, 8.2.1, and 9.0 LiveCycle Data Services versions 2.5.1, 2.6.1, and 3.0 Flex Data Services version 2.0.1 ColdFusion versions 7.0.2, 8.0, 8.0.1, and 9.0 Description The issue allows remot...