CVE-2011-0735

Cross-site scripting XSS vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."...

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the...

Information disclosure

DISPUTED Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an id=- query to a .cfm file...

Information disclosure

DISPUTED Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debu...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."...

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the...

CVE-2011-0737

Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output...

CVE-2011-0733

CVE-2011-0733 is an XSS vulnerability in Adobe ColdFusion prior to 9.0.1 CHF1. An attacker can inject arbitrary script/HTML via the User-Agent HTTP header when issuing an id=- query to a .cfm file. Root cause details are not provided beyond the description; affected software is Adobe ColdFusion b...

CVE-2011-0734

Cross-site scripting XSS vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as...

CVE-2011-0735

Adobe ColdFusion before 9.0.1 CHF1 is vulnerable to cross-site scripting (XSS) via vectors involving a “tag script.” The issue allows remote attackers to inject arbitrary web script or HTML. The connected documents do not provide exploit details or remediation steps.

CVE-2011-0733

Cross-site scripting XSS vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an id=- query to a .cfm file...

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the...

CVE-2011-0735

Cross-site scripting XSS vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."...

CVE-2011-0734

The CVE-2011-0734 entry describes a Cross-site scripting (XSS) vulnerability in Adobe ColdFusion prior to 9.0.1 CHF1, allowing remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element (a “tag body” attack). Affecte...

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier: when a web app uses a DBMS, remote attackers can cause information disclosure of database structure via an id=- query to a .cfm file. The vendor disputes severity; mitigation advised by ColdFusion Lockdown guide is proper Site-wide Error Handler and Debug ...

CVE-2011-0737

Adobe ColdFusion 9.0.1 CHF1 and earlier is affected by an information-disclosure vulnerability where an id=- query to a .cfm file can reveal the installation path in an error message. Root cause is not fully detailed beyond the error disclosure; vendor notes the issue is mitigated by the Site-wid...

CVE-2011-0737

Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output...

PT-2011-2597 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 9.0.1 CHF1 and earlier Description: The issue allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file when a web application is configured to...