2911 matches found
CVE-2006-5860
Cross-site scripting XSS vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors...
CVE-2006-5860
Cross-site scripting XSS vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors...
CVE-2006-5860
CVE-2006-5860 is an XSS vulnerability affecting Adobe JRun 4.0 in its administrator console as used with ColdFusion. The available connected sources confirm the flaw allows an attacker to inject arbitrary web script or HTML into the admin browser session, via unknown vectors. The JVN entry additi...
CVE-2006-5859
Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm...
CVE-2006-5859
Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm...
CVE-2006-5859
CVE-2006-5859 is a cross-site scripting vulnerability in Adobe ColdFusion MX 7.x (7.0 and 7.0.1) where Global Script Protection is not enabled. The vulnerability allows remote attackers to inject arbitrary HTML/JS via unknown vectors, with possible references to Linkdirect.cfm, Topnav.cfm, and We...
JVN#48566866 ColdFusion error page cross-site scripting vulnerability
Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected ColdFusion MX 6.X ColdFusion MX 7.X For more information, refer to the vendor's website...
JVN#28356427 ColdFusion cross-site scripting vulnerability
Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct a session hijacking. Solution Products Affected ColdFusion MX 7.X For more information, refer to the vendor's website...
ColdFusion / JRun on IIS Double Encoded NULL Byte Request File Content Disclosure
The version of ColdFusion running on the remote host allows an attacker to view the contents of files not interpreted by ColdFusion itself and hosted on the affected system. The problem is due to the fact that with ColdFusion, URL-encoded filenames are decoded first by IIS and then again by...
Cross site scripting
Cross-site scripting XSS vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP header, which is not sanitized before being displayed in an error page...
CVE-2007-0817
CVE-2007-0817 is a cross-site scripting vulnerability in Adobe ColdFusion web server. The issue stems from failing to sanitize the User-Agent HTTP header before displaying it on the error page, allowing remote attackers to inject arbitrary HTML/script. Some sources note potential session hijackin...
CVE-2007-0817
Cross-site scripting XSS vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP header, which is not sanitized before being displayed in an error page...
ColdFusion Web Server User-Agent HTTP Header Error Message XSS
The version of Adobe ColdFusion running on the remote host fails to properly sanitize user-supplied input to the User-Agent header before using it to generate dynamic content in an error page. A remote, unauthenticated attacker can exploit this issue to inject arbitrary HTML or script code into a...
ColdFusion MX Null Byte Tag XSS Protection Bypass
The version of Adobe ColdFusion running on the remote host is affected by a cross-site scripting vulnerability due to a failure to completely sanitize user-supplied input before using it to generate dynamic content. A remote, unauthenticated attacker can leverage this issue to inject arbitrary HT...
ColdFusion crossite scripting
User-Agent field from HTTP request is used unfiltered in error message text. It's possible to manipulate client's User-Agent field through Flash...
Adobe ColdFusion 6/7 - User_Agent Error Page Cross-Site Scripting
source: https://www.securityfocus.com/bid/22401/info Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website...
Adobe ColdFusion 67 - User_Agent Error Page Cross-Site Scripting
Adobe ColdFusion 67 - UserAgent Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/22401/info Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker could exploit this vulnerability to...
CVE-2006-5858
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...
CVE-2006-5858
CVE-2006-5858 affects Adobe ColdFusion MX 7–7.0.2 and JRun 4 when run on Microsoft IIS. The vulnerability allows remote attackers to read arbitrary files, list directories, or read source code by sending a double URL-encoded NULL byte in a ColdFusion filename (e.g., a .cfm file). This is a server...