CVE-2004-2331

Summary of CVE-2004-2331 (ColdFusion MX 6.1 / 6.1 J2EE): Local users could bypass sandbox security and access sensitive information by using Java reflection to reach trusted Java objects without invoking CreateObject or the cfobject tag. The issue affects ColdFusion MX 6.1 and ColdFusion MX 6.1 J...

CVE-2004-2330

ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields...

CVE-2005-2480

The CVE-2005-2480 entry concerns Fusebox running on ColdFusion (Fusebox 4.1.0). The vulnerability is a cross-site scripting (XSS) flaw where the fuseaction parameter is not quoted in an error page, enabling an attacker to inject arbitrary script/HTML (demonstrated via index.cfm). Connected docume...

CVE-2005-2480

Cross-site scripting XSS vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm...

CVE-2005-2481

ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" question mark character...

CVE-2005-2481

ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" question mark character...

CVE-2005-2481

CVE-2005-2481 affects ColdFusion Fusebox 4.1.0. The issue is that a malformed or invalid fuseaction parameter allows remote attackers to cause an error message that leaks the full server path. Documents confirm the affected product and the nature of the information disclosure, but do not provide ...

Coldfusion Fusebox V4.1.0 Vulnerability

This was discovered by myself over the weekend. I cant find out what versions of fusebox this vulnerability is in but seeing as it affects the main fusebox page I can only assume it is the latest v4.1.0 and possibly some older versions. According to the Fusebox site, What is Fusebox? Fusebox is a...

CVE-2005-2306

The CVE describes a race condition in Macromedia JRun 4.0 and ColdFusion MX 6.1/7.0 where under heavy load JRun may assign a duplicate authentication token to multiple sessions. This could allow authenticated users to gain privileges as other users. Affected components include JRun 4.0 and ColdFu...

CVE-2005-2306

Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could allow authenticated users to gain privileges as other users...

CVE-2005-2306

Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could allow authenticated users to gain privileges as other users...

[SA16081] Macromedia JRun Authentication Token Security Issue

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2001-1514

ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to 1 child processes created with and 2 child processes that call the CreateProcess function and are executed with or end with the CFX extension...

CVE-2001-1514

CVE-2001-1514 affects ColdFusion 4.5 and 5 on Windows when the advanced security sandbox type is set to operating system. The issue is that security context is not properly passed to child processes created with or to those that call CreateProcess and are run via or end with the CFX extension, ...

CVE-2002-1992

The CVE-2002-1992 entry concerns ColdFusion MX: a buffer overflow in jrun.dll when ColdFusion runs with IIS 4/5, enabling remote denial of service via either a long template file name or a long HTTP header. Affected software is ColdFusion MX (jrun.dll) on IIS environments. The underlying cause is...

CVE-2002-1992

Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote attackers to cause a denial of service in IIS via 1 a long template file name or 2 a long HTTP header...

CVE-2004-2204

Macromedia ColdFusion MX 6.0 and 6.1 application server is affected when running with CreateObject or CFOBJECT enabled, allowing local users to perform unauthorized activities and potentially obtain administrative passwords by creating CFML scripts that leverage those features. The reports do not...

CVE-2004-2204

Macromedia ColdFusion MX 6.0 and 6.1 application server, when running with the CreateObject function or CFOBJECT tag enabled, allows local users to conduct unauthorized activities and obtain administrative passwords by creating CFML scripts that use CreateObject or CFOBJECT...

CVE-2002-1700

CVE-2002-1700 describes a cross-site scripting (XSS) flaw in the missing template handler of Macromedia ColdFusion MX. The vulnerability arises because the HTTP request parameter for the template name is not filtered, allowing an attacker to inject script that is echoed in a 404 error message and...

CVE-2002-1700

Cross-site scripting vulnerability XSS in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message...