3444 matches found
Adobe ColdFusion 67 - User_Agent Error Page Cross-Site Scripting
Adobe ColdFusion 67 - UserAgent Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/22401/info Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker could exploit this vulnerability to...
CVE-2006-5858
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...
CVE-2006-5858
CVE-2006-5858 affects Adobe ColdFusion MX 7–7.0.2 and JRun 4 when run on Microsoft IIS. The vulnerability allows remote attackers to read arbitrary files, list directories, or read source code by sending a double URL-encoded NULL byte in a ColdFusion filename (e.g., a .cfm file). This is a server...
CVE-2006-5858: Exposure of Sensitive Information to an Unauthorized Actor
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...
Adobe Macromedia ColdFusion source code leak
Adding twice encoded NULL byte to path allows .CFM file content disclosure...
iDefense Security Advisory 01.09.07: Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability
Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007 I. BACKGROUND Adobe Macromedia ColdFusion is an application server and development framework for websites. More information is...
CVE-2006-5858
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...
ColdFusion MX7信息泄露及跨站脚本漏洞
Macromedia ColdFusion MX是一个功能强大的商业性质的WEB应用服务器。 ColdFusion在处理用户请求时存在多个安全漏洞，远程攻击者可利用漏洞获得敏感信息。 远程攻击者向ColdFusion提交以下格式结束的无效请求，就会导致在返回结果中泄漏服务器路径： /.jws /.cfm /.cfml /.cfc 如果没有提供主机直接/CFIDE/administrator/login.cfm页面，就可以在href标签中获得服务器的内部IP地址。 此外，提交恶意的URL请求，可进行跨站脚本攻击。 Adobe ColdFusion MX 7.00...
ColdFusion MX7多个信息泄露及跨站脚本漏洞
ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion在处理用户请求时存在多个安全漏洞，远程攻击者可能利用这些漏洞获取服务器相关的敏感信息。 如果远程攻击者能够向ColdFusion提交以以下格式结束的无效请求的话，就会导致在返回结果中泄漏服务器路径： /.jws /.cfm /.cfml /.cfc...
CVE-2006-6483
Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting XSS attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte %00 in certain HTML tags, as demonstrated using "%00script" in a tag...
CVE-2006-6482
Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request 1 for a non-existent a JWS, b CFM, c CFML, or d CFC file, which displays the installation path in the resulting error message; or 2 to /CFIDE/administrator/login.cfm without a host, which can reveal the...
CVE-2006-6483
Affected software : Adobe ColdFusion MX 7.x before 7.0.2. Vulnerability : improper sanitization of HTML tags when mitigating XSS, allowing a NULL byte (%00) in certain tags to bypass filters and inject arbitrary web script or HTML. Impact : remote attacker could execute script in the context of t...
CVE-2006-6483
Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting XSS attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte %00 in certain HTML tags, as demonstrated using "%00script" in a tag...
CVE-2006-6482
Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request 1 for a non-existent a JWS, b CFM, c CFML, or d CFC file, which displays the installation path in the resulting error message; or 2 to /CFIDE/administrator/login.cfm without a host, which can reveal the...
CVE-2006-6482
CVE-2006-6482 affects Adobe ColdFusion MX7. The issue allows remote disclosure of sensitive information via URL requests: (1) requesting non-existent files (JWS, CFM, CFML, or CFC) causes error messages revealing the installation path; (2) accessing /CFIDE/administrator/login.cfm without a host c...
CVE-2006-6482: Undefined Security Weakness
Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request 1 for a non-existent a JWS, b CFM, c CFML, or d CFC file, which displays the installation path in the resulting error message; or 2 to /CFIDE/administrator/login.cfm without a host, which can reveal the...
CVE-2006-6483: Undefined Security Weakness
Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting XSS attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte %00 in certain HTML tags, as demonstrated using "%00script" in a tag...
[Full-disclosure] [SBDA] - ColdFusion MX7 - Multiple Vulnerabilities
Just clearing stuff out before Christmas. ======================================================================== = ColdFusion MX7 - Multiple Vulnerabilities = = Vendor Website: = http://www.Adobe.com = = Affected Software: = ColdFusion MX7 and possibly MX6 = = Public disclosure on Monday Decemb...
coldfusionMX7.txt
Just clearing stuff out before Christmas. ======================================================================== = ColdFusion MX7 - Multiple Vulnerabilities = = Vendor Website: = http://www.Adobe.com = = Affected Software: = ColdFusion MX7 and possibly MX6 = = Public disclosure on Monday Decemb...