2917 matches found
Adobe Releases Security Updates for ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip
Adobe has released security updates to address multiple vulnerabilities in ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to revi...
ColdFusion 9-10 - Credential Disclosure Exploit
ColdFusion...
September 2015 Adobe Shockwave Security Patch
Adobe today released a new version of its Shockwave Player that patches two critical vulnerabilities that could be remotely exploited. Adobe said that it is not aware of public exploits for either security flaw. The vulnerability affects Shockwave for Windows, versions 12.1.9.160 and earlier and...
Adobe ColdFusion BlazeDS XXE (APSB15-21) (credentialed check)
The version of Adobe ColdFusion running on the remote Windows host is affected by an XML external entity injection XXE vulnerability in flex-messaging-core.jar due to an incorrect configuration of the XML parser used in the bundled version of BlazeDS. A remote attacker can exploit this, via a...
ColdFusion explosion: from XSS to RCE chain reaction-vulnerability warning-the black bar safety net
In the audit of ColdFusion 1 0 and 1 1 of the admin panel, I found a DOM based cross-site scripting vulnerability. In this article I will show you how to exploit the vulnerability from the ColdFusion application server to get remote code execution. The discovery of this vulnerability, I to the...
Adobe Releases Security Update for ColdFusion
Adobe has released a security update for ColdFusion to address a vulnerability. Exploitation of this vulnerability may allow a remote attacker to obtain sensitive information from an affected system. Users and administrators are encouraged to review the Adobe Security Bulletin APSB15-21 and apply...
Adobe ColdFusion Hotfix
Adobe today pushed out a hotfix to ColdFusion implementations, patching a vulnerability it had already patched nine days ago on the LiveCycle Data Services application framework. Today’s hotfix affects ColdFusion 11, update 5 and earlier, and ColdFusion 10, update 16 and earlier. Hotfixes, unlike...
ColdFusion Version Scanner
This module attempts identify various flavors of ColdFusion up to version 10 as well as the underlying OS. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ColdFusion Version Scanner',...
Adobe ColdFusion suffers from an unspecified cross-site scripting vulnerability (CNVD-2015-02633)
Adobe ColdFusion is a dynamic Web server , its CFML is a programming language , similar to the current JSP in the JSTL. Adobe ColdFusion has an unspecified cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which c...
Microsoft patch day 2015-4-14: the repair of many high-risk IE, Windows, Office vulnerabilities-vulnerability warning-the black bar safety net
Monthly the second Tuesday, Microsoft fixed the patch to fix the day, Microsoft on Tuesday（2015-4-14 the“patch day”on repairing a large number of vulnerabilities, which includes many IE, Windows, Office, high-risk vulnerabilities. Update announcement MS15-0 3 4 announcement MS15-0 3 4 announcemen...
Cross site scripting
Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-0345
Adobe ColdFusion is affected by CVE-2015-0345, a cross-site scripting (XSS) vulnerability in ColdFusion 10 prior to Update 16 and ColdFusion 11 prior to Update 5. The advisory notes an input-validation weakness that allows remote attackers to inject arbitrary script/HTML via unspecified vectors, ...
CVE-2015-0345
Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Adobe Releases Security Updates for Flash Player, ColdFusion, and Flex
Adobe has released three security updates to address multiple vulnerabilities in Flash Player, ColdFusion, and Flex. Exploitation of these vulnerabilities could potentially allow an attacker to take control of the affected system, or lead to a reflected cross-site scripting attack. Users and...
Adobe ColdFusion Unspecified XSS (APSB15-07) (credentialed check)
The version of Adobe ColdFusion running on the remote Windows host is affected by an unspecified reflected cross-site scripting XSS vulnerability due to a failure to properly sanitize user-supplied input. A remote attacker, using a crafted request, can exploit this to execute arbitrary script cod...
VMware Horizon View Multiple Vulnerabilities (VMSA-2015-0003) (VMSA-2015-0008) (POODLE)
The VMware Horizon View installed on the remote Windows host is version 5.x prior to 5.3.4 or version 6.x prior to 6.1. It is, therefore, affected by the following vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0...
CVE-2014-9166
Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service resource consumption via unspecified vectors...
Code injection
Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service resource consumption via unspecified vectors...
CVE-2014-9166
CVE-2014-9166 affects Adobe ColdFusion 10 prior to Update 15 and ColdFusion 11 prior to Update 3, allowing a denial of service via unspecified vectors due to a resource-consumption issue. Exploitation details are not provided in the available documents. Remediation guidance points to applying hot...