[SA15050] Macromedia ColdFusion Error Page Cross-Site Scripting

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Macromedia ColdFusion Error Page Cross-Site Scripting...

CVE-2004-0928

The CVE-2004-0928 family affects Adobe JRun 4.x servers (and ColdFusion MX 6.0/6.1/J2EE) when running with IIS, where a crafted request ending in ";.cfm" can bypass authentication and disclose script/source content (e.g., .asp, .pl, .php). Connected advisories describe URL handling flaws that tri...

CVE-2004-0928

The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm"...

CVE-2004-0928: Undefined Security Weakness

The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm"...

CVE-2005-1022

ColdFusion 6.1 Updater 1 places Java .class files under the web root in the /WEB-INF/cfclasses directory, which allows remote attackers to obtain sensitive information...

CVE-2005-1022

CVE-2005-1022 affects ColdFusion 6.1 Updater 1, where Java .class files are placed under the web root in /WEB-INF/cfclasses. This configuration allows a remote attacker to obtain sensitive information exposed by those class files. The NVD entry documents a public impact of partial confidentiality...

CVE-2005-1022: Undefined Security Weakness

ColdFusion 6.1 Updater 1 places Java .class files under the web root in the /WEB-INF/cfclasses directory, which allows remote attackers to obtain sensitive information...

ColdFusion < 7.0 MX File Disclosure

Binary data 2806.prm...

ColdFusion MX Server Detection (UDP)

Binary data 2804.prm...

Macromedia Security Bulletin - ColdFusion MX 6.1

MPSB05-02 - Workaround available for ColdFusion MX 6.1 Updater file disclosure. Originally posted: April 7, 2005 http://www.macromedia.com/go/mpsb05-02 Summary: ColdFusion 6.1 Updater 1 in the ColdFusion MX for JRun4 configuration only creates a /WEB-INF/cfclasses directory under the web server...

Macromedia Coldfusion MX application server information leak

Compilde JAVA pages are stored in the Web accessible directory...

ColdFusion MX Server Detection

Binary data 2805.prm...

CVE-2001-1427

Technical details of CVE-2001-1427 are not publicly available in the provided documents. Please monitor for updates from official advisories; current sources describe an unknown vulnerability in ColdFusion Server 2.0–4.5.1 SP2 without specifics.

CVE-2001-1427

Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors...

CVE-2001-1427: Undefined Security Weakness

Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors...

CVE-2004-2505

Macromedia ColdFusion MX before 6.1 does not restrict the size of error messages, which allows remote attackers to cause a denial of service memory consumption and crash by sending repeated GET or POST requests that trigger error messages that use long strings of data...

CVE-2004-2204

Macromedia ColdFusion MX 6.0 and 6.1 application server, when running with the CreateObject function or CFOBJECT tag enabled, allows local users to conduct unauthorized activities and obtain administrative passwords by creating CFML scripts that use CreateObject or CFOBJECT...

CVE-2004-2330

ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields...

CVE-2004-2331

ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag...

PT-2004-3225 · Adobe · Coldfusion Mx

Name of the Vulnerable Software and Affected Versions: ColdFusion MX versions 6.1 and 6.1 J2EE Description: The issue allows local users to bypass sandbox security restrictions and obtain sensitive information. This is achieved by using Java reflection methods to access trusted Java objects witho...