[SA21866] ColdFusion Denial of Service and Sandbox Bypass

TITLE: ColdFusion Denial of Service and Sandbox Bypass SECUNIA ADVISORY ID: SA21866 VERIFY ADVISORY: http://secunia.com/advisories/21866/ CRITICAL: Moderately critical IMPACT: Security Bypass, DoS WHERE: From remote SOFTWARE: Macromedia ColdFusion MX 7 http://secunia.com/product/4984/ DESCRIPTION...

Macromedia ColdFusion authentication bypass

Some AdminAPI API functionality is available without authentication...

CVE-2006-3979

The AdminAPI of ColdFusion MX 7 allows attackers to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion Administrator...

CVE-2006-3979

The AdminAPI of ColdFusion MX 7 allows attackers to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion Administrator...

CVE-2006-3979

CVE-2006-3979 affects ColdFusion MX 7 AdminAPI, where attackers can bypass authentication by using programmatic access to the adminAPI instead of the ColdFusion Administrator. The NVD entry assigns a CVSSv2 base score of 7.2 (HIGH) with local attack vector, low attack complexity, no authenticatio...

CVE-2006-3979: Undefined Security Weakness

The AdminAPI of ColdFusion MX 7 allows attackers to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion Administrator...

ColdFusion Administrative Interface Authentication Bypass

Binary data 3702.prm...

Cross site scripting

Cross-site scripting XSS vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an...

CVE-2006-2364

Cross-site scripting XSS vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an...

CVE-2006-2364

Cross-site scripting XSS vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an...

CVE-2006-2364

CVE-2006-2364 is an XSS vulnerability affecting Macromedia ColdFusion 5 and earlier. The issue arises in the validation feature: if a related normal field is missing or empty, the _required field is not sanitized before being rendered in an error message, allowing remote script/HTML injection. Th...

CVE-2006-2364: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an...

Macromedia ColdFusion MX application server crossite scripting

Crossite scripting with error pages...

yet more XSS in older versions of ColdFusion

This only affects ColdFusion versions 5 and below. It does not affect CFMX. This is similar to previously reported XSS issues with CF, but not identical to any that I have seen reported. Cold Fusion has a "feature" that allows a developer to add validation to HTML forms by using specially named...

CVE-2006-2042

Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the 1 ColdFusion, 2 PHP mySQL, 3 ASP, 4 ASP.NET, and 5 JSP server models...

Sql injection

Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the 1 ColdFusion, 2 PHP mySQL, 3 ASP, 4 ASP.NET, and 5 JSP server models...

CVE-2006-2042

Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the 1 ColdFusion, 2 PHP mySQL, 3 ASP, 4 ASP.NET, and 5 JSP server models...

CVE-2006-2042

CVE-2006-2042 affects Adobe Dreamweaver 8 before 8.0.2 and Dreamweaver MX 2004. The vulnerability arises from code generated by Dreamweaver that does not properly validate input, enabling SQL Injection in the ColdFusion, PHP MySQL, ASP, ASP.NET, and JSP server models. The impact can include remot...

CVE-2006-2042: Undefined Security Weakness

Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the 1 ColdFusion, 2 PHP mySQL, 3 ASP, 4 ASP.NET, and 5 JSP server models...

Sql injection

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 keywords parameters in a Results.cfm, and the 3 ProdID parameter in b Details.cfm...