CVE-2023-38206: Improper Access Control

Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

CVE-2023-38205: Improper Access Control

Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

CVE-2023-29298: Improper Access Control

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

cfc.gov.lk Cross Site Scripting vulnerability OBB-2436184

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

cfc-fanpage.de XSS vulnerability

Open Bug Bounty ID: OBB-611528 Description| Value ---|--- Affected Website:| cfc-fanpage.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Siemens SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER Insufficiently Qualified Paths (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-064-02 Siemens SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER Insufficiently Qualified Paths that was published March 5, 2015, on the NCCIC/ICS‑CERT web site. Ivan Sanchez from...

PT-2015-5375

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC ProSave versions prior to 13 SP1 Siemens SIMATIC CFC versions prior to 8.0 SP4 Upd9 and 8.1 Upd1 Siemens SIMATIC STEP 7 versions prior to 5.5 SP1 HF2, 5.5 SP2 HF7, 5.5 SP3, and 5.5 SP4 HF4 Siemens SIMOTION Scout versions prior ...

CVE-2015-1594: Undefined Security Weakness

Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to ga...

CVE-2014-6851

The New Beginnings CFC aka com.goodbarber.nbcfc application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6851

The CVE-2014-6851 entry concerns The New Beginnings CFC (com.goodbarber.nbcfc) Android app, version 1.1, which does not verify X.509 certificates from SSL servers. This behavior allows man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certifica...

CVE-2014-6851: Undefined Security Weakness

The New Beginnings CFC aka com.goodbarber.nbcfc application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2013-3350

Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components CFC public methods via WebSockets...

CVE-2013-3350

Adobe ColdFusion 10 prior to Update 11 is vulnerable to a WebSockets-based issue that allows remote invocation of ColdFusion Components (CFC) public methods, exposing a risk of arbitrary method invocation on affected servers. Publicly documented behavior in multiple feeds points to remote access ...

PT-2013-4312

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion version 10 before Update 11 Description The issue allows remote attackers to call ColdFusion Components CFC public methods via WebSockets. Recommendations For Adobe ColdFusion version 10, apply Update 11 to resolve the issue...

Adobe ColdFusion CFC方式访问绕过安全限制漏洞

BUGTRAQ ID: 28698 CVECAN ID: CVE-2008-1656 ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion MX的组件访问控制实现上存在漏洞，远程非授权用户可能利用此漏洞获取非授权访问。 即使将访问级别设置为public的话，仍可从Flex 2 remoting调用ColdFusion...

CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 are affected by CVE-2008-1656, where the public access level for CFC methods is not properly enforced, enabling remote invocation of restricted functions via Flex 2 remoting. The root cause is inadequate access control for CFC methods; impact is remote access to funct...

CVE-2008-1656: Undefined Security Weakness

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725...

CVE-2006-4725: Undefined Security Weakness

Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components CFC within a sandbox from CFML templates that are located outside of the sandbox...