CVE-2006-2047

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

CVE-2006-2046

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 keywords parameters in a Results.cfm, and the 3 ProdID parameter in b Details.cfm...

CVE-2006-2046

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 keywords parameters in a Results.cfm, and the 3 ProdID parameter in b Details.cfm...

CVE-2006-2046

CVE-2006-2046 affects Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier. The vulnerability is a set of SQL injection flaws allowing remote attackers to execute arbitrary SQL via unsanitized input in: (a) Results.cfm with the parameters category and keywords , and (b) Details.cfm with...

Cartweaver ColdFusion vuln.

Cartweaver ColdFusion vuln. Vuln. discovered by : r0t Date: 25 april 2006 vendorlink:www.cartweaver.com affected versions:2.16.11 and previous orginal advisory:http://pridels.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html Vuln. Description: 1. SQL Injection vuln. Cartweaver ColdFusion...

CVE-2006-2047: Undefined Security Weakness

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

CVE-2006-2046: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 keywords parameters in a Results.cfm, and the 3 ProdID parameter in b Details.cfm...

Cartweaver 2.16.11 Details.cfm ProdID Parameter SQL Injection

Cartweaver 2.16.11 Details.cfm ProdID Parameter SQL Injection. CVE-2006-2046. Webapps exploit for cfm platform source: http://www.securityfocus.com/bid/17941/info Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitiz...

Cartweaver 2.16.11 - Results.cfm SQL Injection

Cartweaver 2.16.11 - Results.cfm SQL Injection source: https://www.securityfocus.com/bid/17941/info Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before using it in SQL queries. Successfu...

Cartweaver 2.16.11 - 'Results.cfm' SQL Injection

source: https://www.securityfocus.com/bid/17941/info Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before using it in SQL queries. Successful exploits could allow an attacker to compromis...

CVE-2005-4343

Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection Vulnerability"...

CVE-2005-4344

Adobe formerly Macromedia ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObjectJava setting is disabled, which allows local users to create an object despite the specified configuration...

CVE-2005-4342

ColdFusion Sandbox on Adobe formerly Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."...

CVE-2005-4345

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

ColdFusion < 7.01 MX Multiple Vulnerabilities

Binary data 3330.prm...

FarCry XSS vuln.

FarCry XSS vuln. Vuln. discovered by : r0t Date: 17 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/farcry-xss-vuln.html vendor:http://farcry.daemon.com.au/ affected version:3.0 and prior Product Description: FarCry is an open source Content Management System CMS, originally...

CVE-2005-4345

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

CVE-2005-4345

CVE-2005-4345 affects Adobe ColdFusion MX 7.0. The vulnerability arises because the Administrator password hash is exposed via an API call, allowing local developers to obtain the hash and gain privileges. This is documented in the NVD entry for CVE-2005-4345. The connected data confirms the affe...

CVE-2005-4342

CVE-2005-4342 describes a vulnerability in Adobe/Macromedia ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 where the Sandbox does not throw an exception when the SecurityManager is disabled. The underlying issue is a failure to enforce sandbox security, which, according to the description, may al...

CVE-2005-4343

CVE-2005-4343 affects Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0. The vulnerability stems from how the CFMAIL tag handles the Subject field, allowing remote attackers to attach arbitrary files and send mail through applications that use ColdFusion. This is describe...