CVE-2017-11284

CVE-2017-11284 is an insecure deserialization vulnerability in Adobe ColdFusion. The root cause is lack of input validation in the RMI/Flex deserialization path, allowing remote code execution. Affected: ColdFusion 2016 Update 4 and earlier; ColdFusion 11 Update 12 and earlier. Impact (as stated)...

CVE-2017-11285

Adobe ColdFusion has a cross-site scripting XSS vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...

CVE-2017-11285

CVE-2017-11285: Adobe ColdFusion XSS vulnerability in CFML processing. Affects ColdFusion 2016 Update 4 and earlier, and ColdFusion 11 Update 12 and earlier. Root cause is cross-site scripting due to improper input handling; exploitation leads to browser-script execution and potential information...

CVE-2017-11283

CVE-2017-11283 is a Java deserialization flaw in Adobe ColdFusion's insecure handling of untrusted data (notably via DataServicesCFProxy). Affected: ColdFusion 2016 Update 4 and earlier; ColdFusion 11 Update 12 and earlier. The root cause is unsafe deserialization which could allow remote code ex...

Adobe ColdFusion DataServicesCFProxy Insecure Deserialization (CVE-2017-11283)

An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation by the DataServicesCFProxy. A successful attack could lead to a remote code execution...

Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)

An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation on objects in the RMI Registry before deserializing them. A remote, unauthenticated attacker can exploit this vulnerability by sending...

Mura CMS < 6.2 - Server-Side Request Forgery / XML External Entity Injection Vulnerabilities

Exploit for unknown platform in category web applications Exploit Title: Mura CMS before 6.2 SSRF + XXE Date: 30-10-2017 Exploit Author: Anthony Cole Vendor Homepage: http://www.getmura.com/ Version: before 6.2 Contact: http://twitter.com/acole76 Website: http://twitter.com/acole76 Tested on:...

Adobe ColdFusion arbitrary command execution flaws vulnerability 0day(CVE–2017–11283, CVE–2017–11284)early warning-vulnerability warning-the black bar safety net

Adobe ColdFusion in 2017 9 November 12 released a network security update in refer to the previous version, there is a serious deserialization flaws vulnerability bug（CVE-2017-11283, CVE-2017-11284, and may incur long-distance code to fulfill. When applying the Flex integration-do on Remote Adobe...

Adobe ColdFusion Deserialization RCE (CVE-2017-11283, CVE-2017-11238)

During my research into the Java Remote Method Invocation RMI protocol, the most common RMI service that I came across was Adobe ColdFusion’s Flex integration service which is used to support integration between Flash applications and ColdFusion components. A quick look at this service led to the...

clusterd - Application Server Attack Toolkit

clusterd is an open source application server attack toolkit. Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. See the wiki for more information. Requiremen...

Adobe ColdFusion Multiple Vulnerabilities (APSB17-30)

Adobe ColdFusion is prone to information disclosure and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Adobe ColdFusion 11.x < 11u13 / 2016.x < 2016u5 Multiple Vulnerabilities (APSB17-30)

The version of Adobe ColdFusion running on the remote Windows host is 11.x prior to update 13 or 2016.x prior to update 5. It is, therefore, affected by multiple vulnerabilities : - A Java deserialization flaw exists that allows an unauthenticated, remote attacker to execute arbitrary code...

Adobe ColdFusion APSB17-30 Remote Command Execution Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. A security vulnerability exists in Adobe ColdFusion 2016 release Update 4 and earlier and ColdFusion 11 Upda...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2017-32686)

Adobe ColdFusion is a dynamic Web server product that runs CFML which is a programming language for Web applications. A cross-site scripting vulnerability exists in Adobe ColdFusion, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2017-32687)

Adobe ColdFusion is a dynamic Web server product that runs CFML which is a programming language for Web applications. Adobe ColdFusion fails to properly restrict references to XML external entities, allowing remote attackers to exploit vulnerabilities to submit special requests, obtain sensitive...

Adobe ColdFusion APSB17-30 Remote Command Execution Vulnerability (CNVD-2017-30530)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. A security vulnerability exists in Adobe ColdFusion 2016 release Update 4 and earlier and ColdFusion 11 Upda...

Adobe Patches Two Critical RCE Vulnerabilities in Flash Player

Adobe may kill Flash Player by the end of 2020, but until then, the company would not stop providing security updates to the buggy software. As part of its monthly security updates, Adobe has released patches for eight security vulnerabilities in its three products, including two vulnerabilities ...

September Patch Tuesday: 27 Critical Vulnerabilities from Microsoft, plus Critical Adobe Patches

Today Microsoft released a fairly large batch of patches covering 81 vulnerabilities as part of September’s Patch Tuesday update, with 38 of them impacting Windows. Patches covering 27 of these vulnerabilities are labeled as Critical, and 39 can result in Remote Code Execution RCE. According to...

Adobe Fixes Eight Vulnerabilities in Flash, RoboHelp, ColdFusion

Adobe fixed eight vulnerabilities across three products, including two critical memory corruption bugs and a critical XML parsing flaw, with its regularly scheduled update on Tuesday. RoboHelp for Windows, ColdFusion, and as usual, Flash Player, all received updates as part of the company’s Patch...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe RoboHelp, Flash Player, and ColdFusion. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Adobe Security...