CVE-2006-6483: Undefined Security Weakness

Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting XSS attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte %00 in certain HTML tags, as demonstrated using "%00script" in a tag...

CVE-2006-6482: Undefined Security Weakness

Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request 1 for a non-existent a JWS, b CFM, c CFML, or d CFC file, which displays the installation path in the resulting error message; or 2 to /CFIDE/administrator/login.cfm without a host, which can reveal the...

CVE-2006-3978

Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary code via unknown attack vectors...

CVE-2006-3978

Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary code via unknown attack vectors...

CVE-2006-3978

The CVE-2006-3978 entry covers an unspecified vulnerability in a Verity third‑party library used by Adobe ColdFusion MX 7 through MX 7.0.2 (and possibly other products). The vulnerability is described as allowing local users to execute arbitrary code via unknown attack vectors, i.e., a local priv...

CVE-2006-3978: Undefined Security Weakness

Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary code via unknown attack vectors...

CVE-2006-4725

Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components CFC within a sandbox from CFML templates that are located outside of the sandbox...

CVE-2006-4726

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page...

CVE-2006-4724

Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service infinite loop via unspecified vectors involving a crafted command...

CVE-2006-4725: Undefined Security Weakness

Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components CFC within a sandbox from CFML templates that are located outside of the sandbox...

CVE-2006-4726

CVE-2006-4726 concerns a cross-site scripting (XSS) flaw in Adobe ColdFusion MX 6.1 through 7.02. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a ColdFusion error page. The NVD entry shows a low overall severity (CVSS v2 base s...

CVE-2006-4726: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page...

CVE-2006-4724: Undefined Security Weakness

Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service infinite loop via unspecified vectors involving a crafted command...

CVE-2006-4725

Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components CFC within a sandbox from CFML templates that are located outside of the sandbox...

CVE-2006-4726

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page...

CVE-2005-4343

Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection Vulnerability"...

CVE-2005-4342

ColdFusion Sandbox on Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."...

CVE-2005-4345: Undefined Security Weakness

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

CVE-2005-4343: Undefined Security Weakness

Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection Vulnerability"...

CVE-2005-4344: Undefined Security Weakness

Adobe formerly Macromedia ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObjectJava setting is disabled, which allows local users to create an object despite the specified configuration...