CVE-2011-0735

Adobe ColdFusion before 9.0.1 CHF1 is vulnerable to cross-site scripting (XSS) via vectors involving a “tag script.” The issue allows remote attackers to inject arbitrary web script or HTML. The connected documents do not provide exploit details or remediation steps.

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the...

CVE-2011-0734

The CVE-2011-0734 entry describes a Cross-site scripting (XSS) vulnerability in Adobe ColdFusion prior to 9.0.1 CHF1, allowing remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element (a “tag body” attack). Affecte...

CVE-2011-0737

Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output...

Уязвимости в Adobe ColdFusion

Здравствуйте 3APA3A! Сообщаю вам о найденных мною SQL DB Structure Extraction, Full path disclosure и Cross-Site Scripting уязвимостях в Adobe ColdFusion. Они имеют место на странице детального сообщения об ошибке. 16.11.2010 я приватно сообщил об этом Adobe, но они проигнорировали моё сообщение...

Adobe ColdFusion Cross Site Scripting / Disclosure

Hello list! I want to warn you about SQL DB Structure Extraction, Full path disclosure and Cross-Site Scripting vulnerabilities in Adobe ColdFusion. The vulnerabilities exist at detailed error report page. At 16.11.2010 I privately informed Adobe about it, but they ignored my letter...

ColdFusion 8.0.1 - Arbitrary File Upload / Execution (Metasploit)

$Id: coldfusionfckeditor.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

ColdFusion 8.0.1 Arbitrary File Upload And Execute

$Id: coldfusionfckeditor.rb 10874 2010-11-02 23:51:17Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Adobe ColdFusion Directory Traversal (APSB10-18; CVE-2010-2861)

Adobe ColdFusion is a rapid application development platform that includes advanced features for enterprise integration and development of rich Internet applications. A directory traversal vulnerability has been reported in Adobe ColdFusion. The vulnerability is due to a design weakness in the...

Adobe ColdFusion Directory Traversal Vulnerability

Adobe ColdFusion is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. Adobe ColdFusion 9.0.1 and prior are vulnerable. OpenVAS...

Adobe ColdFusion Detection (HTTP)

HTTP based detection of Adobe ColdFusion. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100773"...

Adobe ColdFusion Directory Traversal Vulnerability (APSB10-18)

Adobe ColdFusion is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Adobe ColdFusion Directory Traversal

Working GET request courtesy of carnal0wnage: http://server/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en LLsecurity added another admin page filename: "/CFIDE/administrator/enter.cfm" !/usr/bin/python CVE-2010-2861 - Adobe ColdFusion...

Adobe ColdFusion 'locale' Parameter Directory Traversal

The version of Adobe ColdFusion running on the remote host is affected by a directory traversal vulnerability in the administrative web interface. Input to the 'locale' parameter of multiple pages is not properly sanitized. A remote, unauthenticated attacker can exploit this by sending specially...

Adobe ColdFusion - Directory Traversal

Adobe ColdFusion - Directory Traversal Working GET request courtesy of carnal0wnage: http://server/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en LLsecurity added another admin page filename: "/CFIDE/administrator/enter.cfm"...

Adobe ColdFusion - Directory Traversal

Working GET request courtesy of carnal0wnage: http://server/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en LLsecurity added another admin page filename: "/CFIDE/administrator/enter.cfm" !/usr/bin/python CVE-2010-2861 - Adobe ColdFusion...

Adobe Coldfusion administration panel directory traversals

Multiple directory traversal vulnerabilities...

CVE-2010-2861

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...

Directory traversal

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...

CVE-2010-2861

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...