EUVD-2004-1471

Malware in sbrugna...

CVE-2006-5860

Cross-site scripting XSS vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

[SA18077] Macromedia JRun Server Two Vulnerabilities

TITLE: Macromedia JRun Server Two Vulnerabilities SECUNIA ADVISORY ID: SA18077 VERIFY ADVISORY: http://secunia.com/advisories/18077/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information, DoS WHERE: From remote SOFTWARE: Macromedia Jrun 4.x http://secunia.com/product/863/...

CVE-2004-0928

The CVE-2004-0928 family affects Adobe JRun 4.x servers (and ColdFusion MX 6.0/6.1/J2EE) when running with IIS, where a crafted request ending in ";.cfm" can bypass authentication and disclose script/source content (e.g., .asp, .pl, .php). Connected advisories describe URL handling flaws that tri...

CVE-2004-0928

The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm"...

CVE-2004-1477

CVE-2004-1477 refers to a cross-site scripting (XSS) vulnerability in the Management Console of Macromedia/JRun 4.0. The vulnerability allows remote attackers to inject arbitrary web script/HTML and potentially hijack a user’s session. Connected sources corroborate that this CVE is part of a set ...

CVE-2004-1478

CVE-2004-1478 concerns JRun 4.0 where improper generation/handling of JSESSIONID enables remote attackers to perform session fixation and hijack HTTP sessions. Root cause: insecure/JSESSIONID management. Impact: remote session hijacking via fixation. Exploitation details are not provided beyond t...

CVE-2004-1478

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session...

JRun Multiple Vulnerabilities (OF, XSS, ID, Hijacking)

The remote host is running JRun, a J2EE application server running on top of IIS or Apache. There are multiple flaws in the remote version of this software : - The JSESSIONID variable is not implemented securely. An attacker may use this flaw to guess the session id number of other users. Only JR...