Design/Logic Flaw

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725...

CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 are affected by CVE-2008-1656, where the public access level for CFC methods is not properly enforced, enabling remote invocation of restricted functions via Flex 2 remoting. The root cause is inadequate access control for CFC methods; impact is remote access to funct...

CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725...

Adobe ColdFusion多个跨站脚本及无效日志漏洞

BUGTRAQ ID: 28205,28207 CVECAN ID: CVE-2008-0643,CVE-2008-0644,CVE-2008-1203 ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 如果ColdFusion应用的Application.cfm或Application.cfc包含有setEncoding函数的话，远程攻击者就可以通过提交恶意请求执行跨站脚本攻击。...

CVE-2008-0643

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-1203

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Authentication flaw

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

Cross site scripting

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...

CVE-2008-0644

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...

CVE-2008-1203

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

CVE-2008-0644

Adobe ColdFusion MX 7.x (7.00, 7.01, 7.02) and ColdFusion 8 are affected by a cross‑site scripting bypass via the setEncoding function. The Seebug entry confirms remote attackers can trigger XSS through inadequate handling of CGI variables and setEncoding, with the impact being bypassed XSS prote...

CVE-2008-0643

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-1203

The CVE-2008-1203 issue affects Adobe ColdFusion 8 and ColdFusion MX7 where the administrator interface does not log failed authentication attempts, potentially enabling brute‑force attacks without detection. Connected sources also document related issues in the same family (e.g., other CVEs in C...

CVE-2008-0644

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...

CVE-2008-0643

Adobe ColdFusion MX 7.x and ColdFusion 8 are affected by a cross-site scripting (XSS) vulnerability. The Seebug entry notes that if an application uses Application.cfm or Application.cfc with setEncoding, or if certain CGI variables are not properly filtered, remote attackers can inject arbitrary...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

Session fixation

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and ColdFusion MX 7 are affected by a remote session-fixation vulnerability. The issue arises when established sessions in a ColdFusion application can be hijacked if CFID/CFTOKEN cookies are empty, enabling an attacker to impersonate a user. The CVE-2007-5905 entry lists these...