[Full-Disclosure] Cross Site Scripting fusion news

===================================================================== ========================== DarkBicho ================================ PROGRAM: fusion news HOMEPAGE: http://www.fusionphp.net/ version: 3.6.1 Bug: Cross Site Scripting Date: 22/04/2003 Author: DarkBicho web:...

Fusionphp Fusion News 3.6.1 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/10203/info An attacker may be capable of executing arbitrary script code in a browser of a target user and within the context of a visited web site. This may potentially lead to theft of cookie based authentication credentials, other attacks are also...

Important: Red Hat Security Advisory: kernel security update

Updated IA64 kernel packages are now available that fix a security vulnerability which may allow local users to gain root privileges and other vulnerabilities. The Linux kernel handles the basic functions of the operating system. This kernel updates several important drivers and fixes a number of...

Fusion News 3.3 - Unauthorized Account Addition

Fusion News 3.3 - Unauthorized Account Addition source: https://www.securityfocus.com/bid/8441/info Fusion News is prone to an access validation error allowing a user to add arbitrary user/administrator accounts through manipulating URI parameters. Successful exploitation of this error may allow ...

0006_AP.CF-rds-dump.txt

-- ------------------------- -- - AngryPacket Security Advisory - -- ------------------------- -- - +--------------------- -- - + advisory information +------------------ -- - Exploit Code: Victim1 Initial Bug Report By: rs2112 release date: 06/26/2003 +------------------- -- - + timeline of...

Multiple bugs in Macromedia Cold Fusion MX

Path disclosure, DoS...

Allaire Forums does not verify user information stored in hidden form fields

Overview Allaire Forums does not verify user information submitted in hidden fields on a web form, allowing attackers to impersonate other users. Description Allaire Forums is a web-based bulletin board system that runs on Cold Fusion. When a user wishes to post a message, Allaire Forums...

DoS через таг CFRETHROW в Cold Fusion

Таг CFRETHROW приводит к краху сервера...

cold fusion 5.0 cfrethrow exploit

Vulnerable: Cold Fusion 5.0 Invulnerable: Versions of Cold Fusion below 5.0 do not seem to have the same problem. OS: Only tried on RedHat Linus 2.4.2-2 1 Allaire reports a Cold Fusion bug that can be found at this address: http://www.allaire.com/Handlers/index.cfm?ID=17560&Method=Full. The bug...

Cold Fusion Administration Page Overflow DoS

A denial of service vulnerability exists within the Allaire ColdFusion web application server version 4.5.1 and earlier which allows an attacker to overwhelm the web server and deny legitimate web page requests. By downloading and altering the login HTML form, an attacker can send overly large...

Cold Fusion Server 4.5.1 DoS Vulnerability.

Exploit Announcement Title: Cold Fusion Server 4.5.1 Denial-of-Service Attack using CFCACHE. OS: Windows NT 4.0 Affected Product Versions: Cold Fusion Server 4.5.x, Professional & Enterprise. - Acknowledgements Thanks are due to Patrick Keating, for his help diagnosing and discovering this issue...

CVE-2000-0057

Allaire ColdFusion 4.x CFCACHE exposes HTML output by creating temporary .tmp files and a cfcache.map pointing to them, stored in the web root and accessible remotely. Affected products include ColdFusion Server 4.0.x with multiple OSs listed; remediation exists via Allaire Security Bulletin ASB0...

CVE-2000-0057

Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain sensitive system information...

CVE-2000-0057

Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain sensitive system information...

Byte Fusion BFTelnet 1.1 - Long Username Denial of Service

Byte Fusion BFTelnet 1.1 - Long Username Denial of Service source: https://www.securityfocus.com/bid/771/info BFTelnet, a telnet server for Windows NT by Byte Fusion, will crash if a user name of 3090 or more characters is supplied. telnet victim.com Login: 3090 charcter string...

Byte Fusion BFTelnet 1.1 - Long Username Denial of Service

source: https://www.securityfocus.com/bid/771/info BFTelnet, a telnet server for Windows NT by Byte Fusion, will crash if a user name of 3090 or more characters is supplied. telnet victim.com Login: 3090 charcter string...

cfdecrypt.txt

Subject: Re: New Allaire Security Zone Bulletins and KB Articles To: [email protected] On Tue May 25 1999, James Stephens wrote: At 03:00 PM 5/24/99 -0700, [email protected] wrote: ASB99-08: Pages Encrypted with CFCRYPT.EXE Can Be Illegally Decrypted Has anyone seen the program that...

cf40.txt

Ok, I've had CF 4.0 eval for approx. 1 hour now, and here's over a half dozen more reasons to not use sample pages: http://server/cfdocs/exampleapp/docs/sourcewindow.cfm?Template= --shows you contents of any file you want http://server/cfdocs/snippets/evaluate.cfm --if the expression evaluator ha...

cfusion.txt

L0pht Security Advisory ------------- URL Origin: http://www.l0pht.com/advisories.html Release Date: April 20th, 1999 Application: Cold Fusion Application Server Severity: Web users can download, delete and even upload executable files to a Cold Fusion server. Access is not limited to files under...