CVE-2005-4345

CVE-2005-4345 affects Adobe ColdFusion MX 7.0. The vulnerability arises because the Administrator password hash is exposed via an API call, allowing local developers to obtain the hash and gain privileges. This is documented in the NVD entry for CVE-2005-4345. The connected data confirms the affe...

CVE-2005-4345

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

CVE-2005-4344

Adobe formerly Macromedia ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObjectJava setting is disabled, which allows local users to create an object despite the specified configuration...

CVE-2005-4343

Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection Vulnerability"...

CVE-2005-4343

CVE-2005-4343 affects Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0. The vulnerability stems from how the CFMAIL tag handles the Subject field, allowing remote attackers to attach arbitrary files and send mail through applications that use ColdFusion. This is describe...

CVE-2005-4342

CVE-2005-4342 describes a vulnerability in Adobe/Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 where the Sandbox does not throw an exception when the SecurityManager is disabled. The underlying issue is a failure to enforce sandbox security, which, according to the description, may al...

CVE-2005-4342

ColdFusion Sandbox on Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."...

CVE-2005-4344

CVE-2005-4344 affects Adobe ColdFusion MX 7.0. The root cause is that the CFOBJECT /CreateObject(Java) configuration is not honored when disabled, allowing local users to create an object despite the setting. The NVD data indicates a low overall risk (CVSS v2 base score 2.1) with local attack vec...

CF_Nuke 4.6 - index.cfm Local File Inclusion

CFNuke 4.6 - index.cfm Local File Inclusion source: https://www.securityfocus.com/bid/15777/info CFNuke is prone to a local file include vulnerability. This is due to a lack of sanitization of user-supplied input. This may facilitate the unauthorized viewing of files and unauthorized execution of...

CF_Nuke 4.6 - 'index.cfm' Local File Inclusion

source: https://www.securityfocus.com/bid/15777/info CFNuke is prone to a local file include vulnerability. This is due to a lack of sanitization of user-supplied input. This may facilitate the unauthorized viewing of files and unauthorized execution of local ColdFusion code. It should be noted...

CF_Nuke v4.6 Multiple vuln.

CFNuke v4.6 Multiple vuln. Vuln. dicovered by : r0t Date: 6 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/cfnuke-v46-multiple-vuln.html vendor:http://www.mycfnuke.com/ affected version:v4.6 and prior Product Description: CFNuke is a free easy-to-setup & easy-to-use open source...

CF_Nuke v4.6 Multiple vuln.

CFNuke v4.6 Multiple vuln. Vuln. dicovered by : r0t Date: 6 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/cfnuke-v46-multiple-vuln.html vendor:http://www.mycfnuke.com/ affected version:v4.6 and prior Product Description: CFNuke is a free easy-to-setup & easy-to-use open source...

ColdFusion Debug Mode

It is possible to see the ColdFusion Debug Information by appending ?Mode=debug at the end of the request like GET /index.cfm?Mode=debug. 4.5 and 5.0 are definitely concerned probably in addition older versions. The Debug Information usually contain sensitive data such as Template Path or Server...

Macromedia ColdFusion MX Path Disclosure Vulnerability

A vulnerability has been reported for Macromedia ColdFusion MX that may reveal the physical path information to attackers. SPDX-FileCopyrightText: 2003 A.D.Consulting France Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Web Server Cross Site Scripting

The remote web server seems to be vulnerable to a Cross Site Scripting vulnerability XSS. The vulnerability is caused by the result being returned to the user when a non-existing file is requested e.g. the result contains script code provided in the request. This vulnerability would allow an...

Macromedia ColdFusion MX Path Disclosure Vulnerability

A vulnerability has been reported for Macromedia ColdFusion MX that may reveal the physical path information to attackers. When certain malformed URL requests port 8500 are received by the server, an error message is returned containing the full path of the ColdFusion installation. OpenVAS...

Cold Fusion Administration Page Overflow

A denial of service vulnerability exists within the Allaire ColdFusion web application server version 4.5.1 and earlier which allows an attacker to overwhelm the web server and deny legitimate web page requests. By downloading and altering the login HTML form an attacker can send overly large...

Cold Fusion Administration Page Overflow

A denial of service vulnerability exists within the Allaire ColdFusion web application server version 4.5.1 and earlier which allows an attacker to overwhelm the web server and deny legitimate web page requests. SPDX-FileCopyrightText: 2000 Matt Moore Some text descriptions might be excerpted fro...

CVE-2004-2505

CVE-2004-2505 affects Macromedia ColdFusion MX prior to 6.1. The issue arises because error messages are not restricted in size, which can be exploited to cause a denial of service through repeated GET/POST requests that trigger large error outputs. The provided documents specify the affected pro...

CVE-2004-2331

ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag...