CVE-2008-0644

Adobe ColdFusion MX 7.x (7.00, 7.01, 7.02) and ColdFusion 8 are affected by a cross‑site scripting bypass via the setEncoding function. The Seebug entry confirms remote attackers can trigger XSS through inadequate handling of CGI variables and setEncoding, with the impact being bypassed XSS prote...

CVE-2008-1203

The CVE-2008-1203 issue affects Adobe ColdFusion 8 and ColdFusion MX7 where the administrator interface does not log failed authentication attempts, potentially enabling brute‑force attacks without detection. Connected sources also document related issues in the same family (e.g., other CVEs in C...

CVE-2008-1203: Undefined Security Weakness

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

CVE-2008-0643: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-0644: Undefined Security Weakness

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...

Session fixation

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and ColdFusion MX 7 are affected by a remote session-fixation vulnerability. The issue arises when established sessions in a ColdFusion application can be hijacked if CFID/CFTOKEN cookies are empty, enabling an attacker to impersonate a user. The CVE-2007-5905 entry lists these...

Adobe ColdFusion CFID/CFTOKEN会话劫持漏洞

BUGTRAQ ID: 26429 CVECAN ID: CVE-2007-5905 ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion在处理用户会话时存在漏洞，远程攻击者可能利用此漏洞获取敏感信息。 对于使用ColdFusion编译的应用程序，远程攻击者可以通过CFID或CFTOKEN劫持应用程序的用户会话，然后就可以浏览敏感信息或扮演成为合法用户执行请求。使用J2EE会话管理的用户不受这个漏洞影响。 Adobe...

CVE-2007-5905: Undefined Security Weakness

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2003-1469

The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to obtain the full path of the web server via a direct request to CFIDE/probe.cfm, which leaks the path in an error message...

CVE-2003-1469

The CVE: CVE-2003-1469 affects Macromedia ColdFusion MX. The default configuration enables Robust Exception Information, which allows remote attackers to obtain the web server’s full path via a direct request to CFIDE/probe.cfm, leaking the path in an error message. Affected component is the CFID...

CVE-2003-1469: Exposure of Sensitive Information to an Unauthorized Actor

The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to obtain the full path of the web server via a direct request to CFIDE/probe.cfm, which leaks the path in an error message...

cartweaver-sql.txt

author:meoconxatvnbrain.net product:CartWeaver main site:www.cartweaver.com 1.with CFM CartWeaver: sql injection in: Details.cfm?ProdID=a' demo: http://www.jbracing.co.uk/Details.cfm?ProdID=1' exploit: http://www.xxx.com/Details.cfm?ProdID=sql query link admin: http://www.xxx.com/script...

CVE-2007-3339

Multiple cross-site scripting XSS vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the 1 FTVARLINKP and 2 FTVARURLP parameters to a forum/include/error/autherror.cfm, and...

CVE-2007-3339

Multiple cross-site scripting XSS vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the 1 FTVARLINKP and 2 FTVARURLP parameters to a forum/include/error/autherror.cfm, and...

fusetalkautherror-xss.txt

Hello everyone, After trying to report a SQL bug autherror.cfm to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure...

FuseTalk Multiple Script XSS

The remote host is running FuseTalk, a discussion forum implemented in ColdFusion. The version of FuseTalk installed on the remote host fails to properly sanitize user-supplied input to several parameters and scripts before using it to generate dynamic content. An unauthenticated, remote attacker...

CVE-2007-3339: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the 1 FTVARLINKP and 2 FTVARURLP parameters to a forum/include/error/autherror.cfm, and...