PT-2010-1185

Name of the Vulnerable Software and Affected Versions BlazeDS versions 3.2 and earlier LiveCycle versions 8.0.1, 8.2.1, and 9.0 LiveCycle Data Services versions 2.5.1, 2.6.1, and 3.0 Flex Data Services version 2.0.1 ColdFusion versions 7.0.2, 8.0, 8.0.1, and 9.0 Description The issue allows remot...

Default configuration

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL...

CVE-2010-0185

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL...

CVE-2010-0185

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL...

CVE-2010-0185

CVE-2010-0185 concerns the default configuration of Adobe ColdFusion 9.0 with the Solr Service. The issue allows remote attackers to access collections created by Solr, leaking collection metadata, search information, and index data via an unspecified URL due to insufficient access restrictions o...

CVE-2010-0185: Undefined Security Weakness

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL...

Adobe ColdFusion <= 8.0.1 _logintowizard.cfm XSS

The version of ColdFusion running on the remote host is affected by a cross-site scripting vulnerability. The 'logintowizard.cfm' and 'index.cfm' scripts do not sanitize the query string of the URL, which can result in the injection of arbitrary HTML or script code. A remote attacker can exploit...

Adobe ColdFusion Detection

Adobe ColdFusion formerly Macromedia ColdFusion, a rapid application development platform, is running on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42339; scriptversion"1.16"; scriptsetattributeattribute:"pluginmodificationdate",...

Adobe ColdFusion Server Cross-Site Request Forgery (APSB09-12; CVE-2009-1872)

Multiple Cross Site Scripting XSS and Cross-Site Request Forgery XSRF vulnerabilities have been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a cross-site...

Adobe ColdFusion Server URL Manipulation Cross-Site Scripting (APSB09-12; CVE-2009-1875)

A Cross Site Scripting XSS vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a cross-site scripting attack that could potentially lead to cod...

Adobe ColdFusion Server Null Character Information Disclosure (APSB09-12; CVE-2009-1876)

An information disclosure vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to obtain sensitive information. The vulnerability is due to a double-encode...

Adobe ColdFusion Server Load URL Cross-Site Scripting (APSB09-12; CVE-2009-1877)

A Cross Site Scripting XSS vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a reflected cross-site scripting attack on web sites using the...

Adobe ColdFusion On Apache Double Encoded NULL Byte Request File Content Disclosure

The remote host is running a version of ColdFusion on Apache that is affected by an information disclosure vulnerability. When requesting a non-ColdFusion file, appending a double-encoded null byte and an extension handled by ColdFusion such as '.cfm' will display the contents of that file. A...

ColdFusion vulnerable to cross-site scripting

Overview ColdFusion provided by Adobe contains a cross-site scripting vulnerability. ColdFusion from Adobe is a software to develop web applications. ColdFusion contains a cross-site scripting vulnerability. This vulnerability is different from JVN28356427 and JVN48566866. Project VEX of UBsecure...

JVN#21388501 ColdFusion vulnerable to cross-site scripting

ColdFusion from Adobe is a software to develop web applications. ColdFusion contains a cross-site scripting vulnerability. This vulnerability is different from JVN28356427 and JVN48566866. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Apply the...

Null pointer dereference

Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to 2 wizards/common/logintowizard.cfm, 3...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1875...

Session fixation

Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1877...