2911 matches found
Design/Logic Flaw
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation...
CVE-2014-2867
CVE-2014-2867 concerns PaperThin CommonSpot where an unrestricted file upload vulnerability could allow remote code execution by uploading a ColdFusion page. Affected versions are before 7.0.2 and 8.x before 8.0.3 ; vectors are not specified in the provided materials. The connected documents do n...
CVE-2014-2860
CVE-2014-2860 affects PaperThin CommonSpot prior to 7.0.2 and 8.x prior to 8.0.3. The vulnerability is a cross-site scripting (XSS) flaw that can be triggered via a crafted HTTP request to either a ColdFusion or JavaScript component, allowing remote attackers to inject arbitrary web script or HTM...
CVE-2014-2868
CVE-2014-2868 affects PaperThin CommonSpot (before 7.0.2 and 8.x before 8.0.3). The issue allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable, as described in the CVE entries and Red Hat advisory references. Connecte...
CVE-2014-2867
Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors...
Hardware Maker LaCie Admits Yearlong Data Breach
The French computer hardware company LaCie, perhaps best known for their external hard drives, announced this week it fell victim to a data breach that may have put at risk the sensitive information of anyone who has purchased a product off their website during the last year. According to an...
Adobe ColdFusion Unsupported Version Detection (credentialed check)
According to its version, the installation of Adobe ColdFusion running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network...
ColdFusion Extended Support Version Detection (credentialed check)
According to its version, there is at least one installation of ColdFusion that is potentially under Extended Support. Note that the Extended Support program requires a vendor contract. Extended Support provides upgrades and security fixes for two years after regular support ends. C Tenable Netwo...
ColdFusion Extended Support Version Detection
According to its version, there is at least one installation of ColdFusion on the remote host that is potentially under Extended Support. Note that the Extended Support program requires a vendor contract. Extended Support provides upgrades and security fixes for two years after regular support...
Adobe ColdFusion Unsupported Version Detection
According to its version, the installation of Adobe ColdFusion running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. %NASLMINLEVEL 70300...
Adobe ColdFusion 9 Administrative Login Bypass Vulnerability
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Its password can by default or by misconfiguration be set to an empty value. This allows you to create a session via the RDS login that can be carried over to the admin web interfa...
Adobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe ColdFusion 9 Administrative Login Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attacker...
Adobe ColdFusion 9 Administrative Login Bypass
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe ColdFusion 9 Administrative Login Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attacker...
Adobe ColdFusion 9 Administrative Login Bypass
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to th...
Adobe ColdFusion scheduleedit.cfm Directory Traversal (CVE-2013-0629)
A directory traversal vulnerability has been reported in Adobe ColdFusion...
Adobe ColdFusion is vulnerable to cross-site scripting via the logviewer directory
Overview Adobe ColdFusion 10 update 11 and possibly earlier versions contain a reflected cross-site scripting XSS CWE-79 vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Adobe ColdFusion 10 update 11 and possibly earlier version...
Adobe ColdFusion Multiple Vulnerabilities (APSB13-27) (credentialed check)
The remote Windows host is running a version of ColdFusion that is affected by the following vulnerabilities : - A reflected cross-site scripting vulnerability exists because ColdFusion does not sanitize user-supplied input. This can be exploited by a remote, authenticated user when the CFIDE...
Security updates for available for Adobe Flash Player and ColdFusion vulnerabilities
Adobe released critical security patches for its ColdFusion web application server and Adobe Flash Player for Mac, Windows and Linux. Adobe AIR and the AIR SDK and Compiler are also being updated. These updates address vulnerabilities that could cause a crash and potentially allow an attacker to...
