yet more XSS in older versions of ColdFusion

This only affects ColdFusion versions 5 and below. It does not affect CFMX. This is similar to previously reported XSS issues with CF, but not identical to any that I have seen reported. Cold Fusion has a "feature" that allows a developer to add validation to HTML forms by using specially named...

CVE-2006-2042

Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the 1 ColdFusion, 2 PHP mySQL, 3 ASP, 4 ASP.NET, and 5 JSP server models...

Sql injection

Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the 1 ColdFusion, 2 PHP mySQL, 3 ASP, 4 ASP.NET, and 5 JSP server models...

CVE-2006-2042

Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the 1 ColdFusion, 2 PHP mySQL, 3 ASP, 4 ASP.NET, and 5 JSP server models...

CVE-2006-2042

CVE-2006-2042 affects Adobe Dreamweaver 8 before 8.0.2 and Dreamweaver MX 2004. The vulnerability arises from code generated by Dreamweaver that does not properly validate input, enabling SQL Injection in the ColdFusion, PHP MySQL, ASP, ASP.NET, and JSP server models. The impact can include remot...

Sql injection

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 keywords parameters in a Results.cfm, and the 3 ProdID parameter in b Details.cfm...

CVE-2006-2046

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 keywords parameters in a Results.cfm, and the 3 ProdID parameter in b Details.cfm...

CVE-2006-2047

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

CVE-2006-2046

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 keywords parameters in a Results.cfm, and the 3 ProdID parameter in b Details.cfm...

CVE-2006-2046

CVE-2006-2046 affects Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier. The vulnerability is a set of SQL injection flaws allowing remote attackers to execute arbitrary SQL via unsanitized input in: (a) Results.cfm with the parameters category and keywords , and (b) Details.cfm with...

Cartweaver ColdFusion vuln.

Cartweaver ColdFusion vuln. Vuln. discovered by : r0t Date: 25 april 2006 vendorlink:www.cartweaver.com affected versions:2.16.11 and previous orginal advisory:http://pridels.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html Vuln. Description: 1. SQL Injection vuln. Cartweaver ColdFusion...

Cartweaver 2.16.11 Details.cfm ProdID Parameter SQL Injection

Cartweaver 2.16.11 Details.cfm ProdID Parameter SQL Injection. CVE-2006-2046. Webapps exploit for cfm platform source: http://www.securityfocus.com/bid/17941/info Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitiz...

Cartweaver 2.16.11 - Results.cfm SQL Injection

Cartweaver 2.16.11 - Results.cfm SQL Injection source: https://www.securityfocus.com/bid/17941/info Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before using it in SQL queries. Successfu...

Cartweaver 2.16.11 - 'Results.cfm' SQL Injection

source: https://www.securityfocus.com/bid/17941/info Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before using it in SQL queries. Successful exploits could allow an attacker to compromis...

CVE-2005-4342

ColdFusion Sandbox on Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."...

CVE-2005-4344

Adobe formerly Macromedia ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObjectJava setting is disabled, which allows local users to create an object despite the specified configuration...

CVE-2005-4343

Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection Vulnerability"...

CVE-2005-4345

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

ColdFusion < 7.01 MX Multiple Vulnerabilities

Binary data 3330.prm...

FarCry XSS vuln.

FarCry XSS vuln. Vuln. discovered by : r0t Date: 17 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/farcry-xss-vuln.html vendor:http://farcry.daemon.com.au/ affected version:3.0 and prior Product Description: FarCry is an open source Content Management System CMS, originally...