CVE-2015-8053: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052...

CVE-2015-5255: Improper Input Validation

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to...

PT-2015-2739

Name of the Vulnerable Software and Affected Versions Adobe BlazeDS versions prior to 3.0.0.354175 Adobe BlazeDS versions 3.1.x prior to 3.1.0.354180 Adobe BlazeDS versions 4.5.x prior to 4.5.1.354177 Adobe BlazeDS versions 4.6.2.x prior to 4.6.2.354178 Adobe BlazeDS versions 4.7.x prior to...

CVE-2015-8052: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053...

PT-2015-2757

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 through 10 before Update 18 Adobe ColdFusion versions 11 through 11 before Update 7 Description The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web...

PT-2015-2756

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 before Update 18 Adobe ColdFusion versions 11 before Update 7 Description The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via...

Adobe Issues HotFix For ColdFusion

Adobe this afternoon released hotfixes and security updates for three of its products that patch a handful of vulnerabilities, none of which are being publicly exploited. The most serious vulnerabilities were in ColdFusion, Adobe’s web application development platform. The hotfix affects ColdFusi...

Adobe Releases Security Updates for ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip

Adobe has released security updates to address multiple vulnerabilities in ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to revi...

ColdFusion 9-10 - Credential Disclosure Exploit

ColdFusion...

September 2015 Adobe Shockwave Security Patch

Adobe today released a new version of its Shockwave Player that patches two critical vulnerabilities that could be remotely exploited. Adobe said that it is not aware of public exploits for either security flaw. The vulnerability affects Shockwave for Windows, versions 12.1.9.160 and earlier and...

Adobe ColdFusion BlazeDS XXE (APSB15-21) (credentialed check)

The version of Adobe ColdFusion running on the remote Windows host is affected by an XML external entity injection XXE vulnerability in flex-messaging-core.jar due to an incorrect configuration of the XML parser used in the bundled version of BlazeDS. A remote attacker can exploit this, via a...

ColdFusion explosion: from XSS to RCE chain reaction-vulnerability warning-the black bar safety net

In the audit of ColdFusion 1 0 and 1 1 of the admin panel, I found a DOM based cross-site scripting vulnerability. In this article I will show you how to exploit the vulnerability from the ColdFusion application server to get remote code execution. The discovery of this vulnerability, I to the...

Adobe Releases Security Update for ColdFusion

Adobe has released a security update for ColdFusion to address a vulnerability. Exploitation of this vulnerability may allow a remote attacker to obtain sensitive information from an affected system. Users and administrators are encouraged to review the Adobe Security Bulletin APSB15-21 and apply...

Adobe ColdFusion Hotfix

Adobe today pushed out a hotfix to ColdFusion implementations, patching a vulnerability it had already patched nine days ago on the LiveCycle Data Services application framework. Today’s hotfix affects ColdFusion 11, update 5 and earlier, and ColdFusion 10, update 16 and earlier. Hotfixes, unlike...

ColdFusion Version Scanner

This module attempts identify various flavors of ColdFusion up to version 10 as well as the underlying OS. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ColdFusion Version Scanner',...

Adobe ColdFusion suffers from an unspecified cross-site scripting vulnerability (CNVD-2015-02633)

Adobe ColdFusion is a dynamic Web server , its CFML is a programming language , similar to the current JSP in the JSTL. Adobe ColdFusion has an unspecified cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which c...

Microsoft patch day 2015-4-14: the repair of many high-risk IE, Windows, Office vulnerabilities-vulnerability warning-the black bar safety net

Monthly the second Tuesday, Microsoft fixed the patch to fix the day, Microsoft on Tuesday（2015-4-14 the“patch day”on repairing a large number of vulnerabilities, which includes many IE, Windows, Office, high-risk vulnerabilities. Update announcement MS15-0 3 4 announcement MS15-0 3 4 announcemen...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-0345

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-0345

Adobe ColdFusion is affected by CVE-2015-0345, a cross-site scripting (XSS) vulnerability in ColdFusion 10 prior to Update 16 and ColdFusion 11 prior to Update 5. The advisory notes an input-validation weakness that allows remote attackers to inject arbitrary script/HTML via unspecified vectors, ...