Adobe ColdFusion Multiple Vulnerabilities (APSB15-29) (credentialed check)

The version of Adobe ColdFusion running on the remote Windows host is affected by multiple vulnerabilities : - Multiple cross-site scripting XSS vulnerabilities exist due to a failure to validate input before returning it to the user. A remote attacker can exploit these to inject arbitrary script...

CVE-2015-8053

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052...

CVE-2015-8052

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053...

CVE-2015-5255

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to...

Server side request forgery (ssrf)

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052...

CVE-2015-8052

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053...

CVE-2015-8053

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052...

CVE-2015-5255

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to...

CVE-2015-5255

CVE-2015-5255 describes a Server-Side Request Forgery (SSRF) in BlazeDS used with Adobe ColdFusion and LiveCycle Data Services. A crafted XML document could cause BlazeDS to send HTTP requests to intranet servers, bypassing access controls and enabling further host‑based attacks. Affected product...

CVE-2015-8053

CVE-2015-8053 is an XSS vulnerability in Adobe ColdFusion, affecting ColdFusion 10 before Update 18 and ColdFusion 11 before Update 7. Remote attackers can inject arbitrary web script or HTML via unspecified vectors. The issue is documented under APSB15-29; affected versions should apply the corr...

CVE-2015-8052

Adobe ColdFusion is affected by CVE-2015-8052 (XSS). The vulnerability exists in ColdFusion 10 prior to Update 18 and ColdFusion 11 prior to Update 7, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The impact is cross-site scripting, enabling an attacker...

Adobe Issues HotFix For ColdFusion

Adobe this afternoon released hotfixes and security updates for three of its products that patch a handful of vulnerabilities, none of which are being publicly exploited. The most serious vulnerabilities were in ColdFusion, Adobe’s web application development platform. The hotfix affects ColdFusi...

Adobe Releases Security Updates for ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip

Adobe has released security updates to address multiple vulnerabilities in ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to revi...

ColdFusion 9-10 - Credential Disclosure Exploit

ColdFusion...

September 2015 Adobe Shockwave Security Patch

Adobe today released a new version of its Shockwave Player that patches two critical vulnerabilities that could be remotely exploited. Adobe said that it is not aware of public exploits for either security flaw. The vulnerability affects Shockwave for Windows, versions 12.1.9.160 and earlier and...

Adobe ColdFusion BlazeDS XXE (APSB15-21) (credentialed check)

The version of Adobe ColdFusion running on the remote Windows host is affected by an XML external entity injection XXE vulnerability in flex-messaging-core.jar due to an incorrect configuration of the XML parser used in the bundled version of BlazeDS. A remote attacker can exploit this, via a...

ColdFusion explosion: from XSS to RCE chain reaction-vulnerability warning-the black bar safety net

In the audit of ColdFusion 1 0 and 1 1 of the admin panel, I found a DOM based cross-site scripting vulnerability. In this article I will show you how to exploit the vulnerability from the ColdFusion application server to get remote code execution. The discovery of this vulnerability, I to the...

Adobe Releases Security Update for ColdFusion

Adobe has released a security update for ColdFusion to address a vulnerability. Exploitation of this vulnerability may allow a remote attacker to obtain sensitive information from an affected system. Users and administrators are encouraged to review the Adobe Security Bulletin APSB15-21 and apply...