3696 matches found
PT-2014-6399
Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions 9.5.2 and earlier ColdFusion versions 8.0.1 and earlier Description A cross-site scripting XSS issue exists in the Help page of the affected software, allowing remote attackers to inject arbitrary web script or HTML...
JVN#84376800: Help Page in multiple Adobe products vulnerable to cross-site scripting
The Help page provided in multiple Adobe products contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version of the product according to the information provided by the developer...
WordPress ColdFusion Theme - Arbitrary File Upload
WordPress ColdFusion theme is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Update the theme...
Allaire ColdFusion Server <= 4.0 - Remote File Display, Deletion, Upload and Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/115/info To display and delete any file on the system use an URL of the following form: http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file To upload files to the sever first find out the...
Macromedia ColdFusion MX 6.1 Template Handling Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11316/info Reportedly Macromedia ColdFusion MX is affected by privilege escalation vulnerability when handling templates. This issue is due to an access validation error that allows a user to perform actions with...
Gafware CFXImage 1.6.4/1.6.6 ShowTemp File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4882/info Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program that allows a malicious...
Macromedia ColdFusion MX 6.0 Oversized Error Message Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10163/info A denial of service vulnerability has been reported in Macromedia ColdFusion MX that is reported to occur when the software attempts to write oversized error messages. These error messages will be logged by the...
Macromedia ColdFusion MX 6.0 Error Message Path Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7443/info A vulnerability has been reported for Macromedia ColdFusion MX that may reveal the physical path information to attackers. When certain malformed URL requests are received by the server, an error message is...
Allaire ColdFusion Server <= 4.0.1 CFCRYPT.EXE Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/275/info A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted. ColdFusion supports the ability to encrypt the CFML templates in an application or component, using the CFCRYPT.E...
Adobe ColdFusion 9 - Administrative Login Bypass
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include...
Adobe ColdFusion Server <= 8.0.1 wizards/common/_authenticatewizarduser.cfm Query String XSS
No description provided by source. source: http://www.securityfocus.com/bid/36046/info Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...
Xeneo Web Server 2.2.9 - Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7398/info Xeneo web server has been reported prone to denial of service vulnerability. It has been reported that a specifically crafted HTTP GET request containing over 4096 bytes of data will trigger this vulnerability...
Cartweaver 2.16.11 Results.cfm category Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/17941/info Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before using it in SQL queries. Successful exploits...
ColdFusion MX Missing Template Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5011/info ColdFusion MX is prone to cross site scripting attacks. Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of ColdFusion. The...
Adobe ColdFusion 9 Administrative Login Bypass
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0819-2 | | http://packetstormsecurity.com/ |...
Adobe ColdFusion Server <= 8.0.1 wizards/common/_logintowizard.cfm Query String XSS
No description provided by source. source: http://www.securityfocus.com/bid/36046/info Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...
Adobe ColdFusion 6/7 User_Agent Error Page Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/22401/info Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker could exploit this vulnerability to execute arbitrary script code in t...
ColdFusion 8.0.1 - Arbitrary File Upload and Execute
No description provided by source. $Id: coldfusionfckeditor.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and term...
CF_Nuke 4.6 Index.CFM Local File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/15777/info CFNuke is prone to a local file include vulnerability. This is due to a lack of sanitization of user-supplied input. This may facilitate the unauthorized viewing of files and unauthorized execution of local...
fusebox (ProductList.cfm?CatDisplay) - Remote SQL Injection Vulnerability
No description provided by source. ----------------------------------------------------------------------------------------- AJSADVISORIES01&2010 fusebox ProductList.cfm?CatDisplay Remote SQL Injection Vulnerability...