CVE-2010-1293

Cross-site scripting XSS vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-1293

Adobe ColdFusion CVE-2010-1293 is an XSS vulnerability affecting the Admin page in ColdFusion 8.0, 8.0.1, and 9.0. The issue arises from improper sanitization in the administrative interface, notably input to cfadminUserId on /CFIDE/administrator/login.cfm when Separate user name and password aut...

Preemptive Protection against Adobe ColdFusion Multiple Cross-Site Scripting Vulnerabilities (APSB10-11)

Multiple cross-site scripting XSS vulnerabilities have been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. Cross-site scripting occurs when a Web-based application fails to validate user input before returning it to...

Adobe Patches 'Critical' Shockwave, ColdFusion holes

Adobe joined the Patch Tuesday train today with the release of patches for at least 21 documented security vulnerabilities in the Shockwave and ColdFusion product lines. According to the APSB10-12 security bulletin, 18 of the 21 flaws affected the Shockwave Player, a free software product that le...

cfm local include exploit-vulnerability warning-the black bar safety net

1.读取metabase.xml/web.xml /password. properities sensitive files,know the www path,coldfusion,coldfusion backend encrypted password ! 2. Local contains the coldfusion logs,write cfm in a word,get a WEBSHELL...

Multiple Adobe Products XML External Entity (XXE) Injection (APSB10-05)

The remote host appears to be running an Adobe product that is susceptible to XML External Entity XXE attacks. The installed version of the product fails to block the use of external XML entities while using the HTTPChannel to transport data in AMFX format. A remote, unauthenticated attacker coul...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

CVE-2009-3960

CVE-2009-3960 is an information-disclosure vulnerability in Adobe BlazeDS and related Adobe data services components (e.g., LiveCycle, ColdFusion) where XML External Entity/XML Injection flaws can allow remote attackers to obtain sensitive information. Root cause: injected tags and external entit...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

CVE-2010-0185

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL...

Default configuration

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL...

CVE-2010-0185

CVE-2010-0185 concerns the default configuration of Adobe ColdFusion 9.0 with the Solr Service. The issue allows remote attackers to access collections created by Solr, leaking collection metadata, search information, and index data via an unspecified URL due to insufficient access restrictions o...

CVE-2010-0185

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL...

Adobe ColdFusion <= 8.0.1 _logintowizard.cfm XSS

The version of ColdFusion running on the remote host is affected by a cross-site scripting vulnerability. The 'logintowizard.cfm' and 'index.cfm' scripts do not sanitize the query string of the URL, which can result in the injection of arbitrary HTML or script code. A remote attacker can exploit...

Adobe ColdFusion Detection

Adobe ColdFusion formerly Macromedia ColdFusion, a rapid application development platform, is running on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42339; scriptversion"1.16"; scriptsetattributeattribute:"pluginmodificationdate",...

Adobe ColdFusion Server Null Character Information Disclosure (APSB09-12; CVE-2009-1876)

An information disclosure vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to obtain sensitive information. The vulnerability is due to a double-encode...

Adobe ColdFusion Server Load URL Cross-Site Scripting (APSB09-12; CVE-2009-1877)

A Cross Site Scripting XSS vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a reflected cross-site scripting attack on web sites using the...

Adobe ColdFusion Server Cross-Site Request Forgery (APSB09-12; CVE-2009-1872)

Multiple Cross Site Scripting XSS and Cross-Site Request Forgery XSRF vulnerabilities have been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a cross-site...

Adobe ColdFusion Server URL Manipulation Cross-Site Scripting (APSB09-12; CVE-2009-1875)

A Cross Site Scripting XSS vulnerability has been discovered in Adobe ColdFusion server. Adobe ColdFusion is an application server for developing dynamically generated Web sites. A remote attacker could exploit this issue to execute a cross-site scripting attack that could potentially lead to cod...