ColdFusion cross-site scripting vulnerability

Overview ColdFusion, web application development software from Adobe, contains a cross-site scripting vulnerability. According to the statements from the developer, this vulnerability does not arise when the "Enable Global Script Protection" setting is turned on. This vulnerability is different...

ColdFusion error page cross-site scripting vulnerability

Overview ColdFusion, web application development software from Adobe, contains a cross-site scripting vulnerability in its error page. This vulnerability is different from JVN28356427. Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is...

Adobe ColdFusion CFC方式访问绕过安全限制漏洞

BUGTRAQ ID: 28698 CVECAN ID: CVE-2008-1656 ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion MX的组件访问控制实现上存在漏洞，远程非授权用户可能利用此漏洞获取非授权访问。 即使将访问级别设置为public的话，仍可从Flex 2 remoting调用ColdFusion...

Design/Logic Flaw

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725...

CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725...

CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725...

CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 are affected by CVE-2008-1656, where the public access level for CFC methods is not properly enforced, enabling remote invocation of restricted functions via Flex 2 remoting. The root cause is inadequate access control for CFC methods; impact is remote access to funct...

CVE-2008-1656: Undefined Security Weakness

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725...

Adobe ColdFusion多个跨站脚本及无效日志漏洞

BUGTRAQ ID: 28205,28207 CVECAN ID: CVE-2008-0643,CVE-2008-0644,CVE-2008-1203 ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 如果ColdFusion应用的Application.cfm或Application.cfc包含有setEncoding函数的话，远程攻击者就可以通过提交恶意请求执行跨站脚本攻击。...

Cross site scripting

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Authentication flaw

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

CVE-2008-0644

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...

CVE-2008-0643

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-1203

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

CVE-2008-0643

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-0644

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...

CVE-2008-1203

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

CVE-2008-0643

Adobe ColdFusion MX 7.x and ColdFusion 8 are affected by a cross-site scripting (XSS) vulnerability. The Seebug entry notes that if an application uses Application.cfm or Application.cfc with setEncoding, or if certain CGI variables are not properly filtered, remote attackers can inject arbitrary...

CVE-2008-0644

Adobe ColdFusion MX 7.x (7.00, 7.01, 7.02) and ColdFusion 8 are affected by a cross‑site scripting bypass via the setEncoding function. The Seebug entry confirms remote attackers can trigger XSS through inadequate handling of CGI variables and setEncoding, with the impact being bypassed XSS prote...