Allaire ColdFusion Server 4.0/4.0.1 - 'CFCACHE' Information Disclosure

source: https://www.securityfocus.com/bid/917/info ColdFusion 4.x includes a function called CFCACHE. This function improves server performance by caching the HTML output of processed CFM pages. When the CFCACHE tag is used in a CFM page, it creates temporary files. Some of these files are .tmp...

CVE-1999-1124

HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host...

CVE-1999-0455

The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly...

CVE-1999-0477

The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly...

coldfusion.fixes.txt

Date: Mon, 24 May 1999 15:00:52 -0700 From: [email protected] To: [email protected] Subject: New Allaire Security Zone Bulletins and KB Articles Dear ColdFusion Customer- Several new security issues that may affect ColdFusion customers have come to our attention recently. Please visit the...

coldfusion.alert.txt

Date: Friday, 30 Apr 1999 17:00:00 -0400 From: [email protected] To: [email protected] Subject: ColdFusion Security Alert Allaire respects the Web and the privacy of those who use it. To avoid future messages from Allaire, send e-mail to [email protected] with the subject:...

ms.odbc.coldfusion.txt

Date: Tue, 1 Jun 1999 11:45:35 -0700 From: [email protected] To: [email protected] Subject: New Allaire Security Bulletin ASB99-09 Dear Allaire Customer -- We have recently become aware of a serious security vulnerability that may affect customers using Microsoft Access with ColdFusion...

ColdFusion Multiple Vulnerabilities (File Upload/Manipulation)

The 'exprcalc.cfm' page in the version of Cold Fusion Application Server running on the remote host allows an unauthenticated, remote attacker to read arbitrary files and possibly delete or upload arbitrary files as well. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Allaire ColdFusion Server 4.0 - Remote File Display Deletion Upload Execution

Allaire ColdFusion Server 4.0 - Remote File Display Deletion Upload Execution source: https://www.securityfocus.com/bid/115/info To display and delete any file on the system use an URL of the following form: http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file To...

Allaire ColdFusion Server 4.0 - Remote File Display / Deletion / Upload / Execution

source: https://www.securityfocus.com/bid/115/info To display and delete any file on the system use an URL of the following form: http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file To upload files to the sever first find out the location of the sample code on the...

Allaire ColdFusion Server 4.0.1 - CFCRYPT.EXE Decrypt Pages

Allaire ColdFusion Server 4.0.1 - CFCRYPT.EXE Decrypt Pages / source: https://www.securityfocus.com/bid/275/info A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted. ColdFusion supports the ability to "encrypt" the CFML templates in an application or...

Allaire ColdFusion Server 4.0.1 - 'CFCRYPT.EXE' Decrypt Pages

/ source: https://www.securityfocus.com/bid/275/info A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted. ColdFusion supports the ability to "encrypt" the CFML templates in an application or component, using the CFCRYPT.EXE utility, so they can be...