PT-2011-2598 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 9.0.1 CHF1 and earlier Description: The issue allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. The vendor disputes the...

Уязвимости в Adobe ColdFusion

Здравствуйте 3APA3A! Сообщаю вам о найденных мною SQL DB Structure Extraction, Full path disclosure и Cross-Site Scripting уязвимостях в Adobe ColdFusion. Они имеют место на странице детального сообщения об ошибке. 16.11.2010 я приватно сообщил об этом Adobe, но они проигнорировали моё сообщение...

Lomtec ActiveWeb Professional 3.0 CMS Allows Arbitrary File Upload and Execution as SYSTEM in ColdFusion (2010-WEB-002) (CERT VU#528212)

------------------------------------------------------------------------------------- www.ExploitDevelopment.com 2010-WEB-002 CERT VU870532 Security Focus BID 45985 ------------------------------------------------------------------------------------- TITLE: Lomtec ActiveWeb Professional 3.0 CMS...

Adobe ColdFusion Cross Site Scripting / Disclosure

Hello list! I want to warn you about SQL DB Structure Extraction, Full path disclosure and Cross-Site Scripting vulnerabilities in Adobe ColdFusion. The vulnerabilities exist at detailed error report page. At 16.11.2010 I privately informed Adobe about it, but they ignored my letter...

Lomtec ActiveWeb Professional 3.0 CMS Shell Upload / SYSTEM Execution

------------------------------------------------------------------------------------- www.ExploitDevelopment.com 2010-WEB-002 CERT VU870532 Security Focus BID 45985 ------------------------------------------------------------------------------------- TITLE: Lomtec ActiveWeb Professional 3.0 CMS...

Lomtec ActiveWeb Professional 3.0 CMS allows arbitrary file upload and execution

Overview Lomtec ActiveWeb Professional 3.0 web content management server allows unauthenticated users to upload arbitrary files. Description According to Lomtec's website: "Lomtec ActiveWeb offers an ideal solution for the creation, maintenance and administration of a Web site and its content. "...

Metasploit Framework v3.5.1 Updated Version Download !

Our favourite exploitation framework – The Metasploit Framework has been updated! We now have Metasploit version 3.5.1! "The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool. The framework includes hundreds of working remote exploits for a...

BlogCFC Cross Site Scripting

http://www.procheckup.com/vulnerabilitymanager/vulnerabilities/pr10-10 PR10-10 Various XSS within BlogCFC Advisory publicly released: Tuesday, 14 December 2010 Vulnerability found: Sunday, 2 May 2010 Vendor informed: Monday, 3 May 2010 Vulnerability fixed: Wednesday, 19 May 2010 Severity level:...

Mura CMS 5.2.2085 Cross Site Scripting

ProCheckUp Research PR10-09 Multiple XSS and Cross Domain redirect within Mura CMS Advisory publicly released: Monday, 13 December 2010 Vulnerability found: Monday, 19 April 2010 Vendor informed: Tuesday, 20 April 2010 Severity level: Medium Credits Richard Brain of ProCheckUp Ltd...

ColdFusion 8.0.1 - Arbitrary File Upload / Execution (Metasploit)

$Id: coldfusionfckeditor.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Adobe XML External Entity Injection

Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2 This module requires Metasploit:...

ColdFusion 8.0.1 Arbitrary File Upload And Execute

$Id: coldfusionfckeditor.rb 10874 2010-11-02 23:51:17Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

ColdFusion 8.0.1 Arbitrary File Upload and Execute

This module exploits the Adobe ColdFusion 8.0.1 FCKeditor 'CurrentFolder' File Upload and Execute vulnerability. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ColdFusion 8.0.1 Arbitrary File...

Mura CMS Detection

Mura CMS, an open source content management system written in ColdFusion, is available through the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid49697; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

Mura CMS FILEID Parameter Directory Traversal

The version of Mura CMS installed on the remote host fails to sanitize user-supplied input to the 'FILEID' parameter of the 'tasks/render/file' script of directory traversal sequences before using it to return the contents of a file. An unauthenticated, remote attacker can exploit this issue to...

Adobe ColdFusion Directory Traversal Vulnerability

No description provided by source. Working GET request courtesy of carnal0wnage: http://server/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en LLsecurity added another admin page filename: "/CFIDE/administrator/enter.cfm" !/usr/bin/pytho...

Blue River Mura CMS Directory Traversal

Sep 24, 2010 Title: Blue River Mura CMS Directory Traversal Version: 1.0 Issue type: Directory Traversal Affected vendor: Blue River Interactive Group Release date: 24/09/2010 Discovered by: Steven Seeley & Rohan Stelling Summary Mura CMS is an open source content management system which is built...

Blue River Mura CMS - Directory Traversal

Blue River Mura CMS - Directory Traversal Sep 24, 2010 Title: Blue River Mura CMS Directory Traversal Version: 1.0 Issue type: Directory Traversal Affected vendor: Blue River Interactive Group Release date: 24/09/2010 Discovered by: Steven Seeley & Rohan Stelling Summary Mura CMS is an open sourc...

Adobe ColdFusion Directory Traversal (APSB10-18; CVE-2010-2861)

Adobe ColdFusion is a rapid application development platform that includes advanced features for enterprise integration and development of rich Internet applications. A directory traversal vulnerability has been reported in Adobe ColdFusion. The vulnerability is due to a design weakness in the...

Adobe ColdFusion Directory Traversal Vulnerability

Adobe ColdFusion is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. Adobe ColdFusion 9.0.1 and prior are vulnerable. OpenVAS...