1187 matches found
New Macromedia Security Zone Bulletin Posted
IMPORTANT: A new security bulletin describes a configuration problem that may affect ColdFusion installations. To learn about this new issue and what actions you can take to address it, please visit the Macromedia Security Zone: http://www.macromedia.com/go/mpsb05-03 MPSB05-03 ColdFusion MX 7...
CVE-2004-1893
CVE-2004-1893 affects Dreamweaver MX. The description states that when “Using Driver On Testing Server” or “Using DSN on Testing Server” is selected, mmhttpdb.asp is uploaded to the site without authentication, allowing remote attackers to obtain sensitive information and potentially execute arbi...
CVE-2005-1555
Cross-site scripting XSS vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page...
CVE-2004-1893
Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a...
CVE-2005-0955
SQL injection vulnerability in InterAKT MX Shop 1.1.1 allows remote attackers to execute arbitrary SQL commands via the idctg parameter...
CVE-2005-0956
Multiple SQL injection vulnerabilities in index.php in InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via the 1 idp, 2 idctg, or 3 idman parameter...
CVE-2004-0928
The CVE-2004-0928 family affects Adobe JRun 4.x servers (and ColdFusion MX 6.0/6.1/J2EE) when running with IIS, where a crafted request ending in ";.cfm" can bypass authentication and disclose script/source content (e.g., .asp, .pl, .php). Connected advisories describe URL handling flaws that tri...
CVE-2004-0928
The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm"...
ColdFusion MX Server Detection (UDP)
Binary data 2804.prm...
ColdFusion < 7.0 MX File Disclosure
Binary data 2806.prm...
Macromedia Security Bulletin - ColdFusion MX 6.1
MPSB05-02 - Workaround available for ColdFusion MX 6.1 Updater file disclosure. Originally posted: April 7, 2005 http://www.macromedia.com/go/mpsb05-02 Summary: ColdFusion 6.1 Updater 1 in the ColdFusion MX for JRun4 configuration only creates a /WEB-INF/cfclasses directory under the web server...
CVE-2005-0955
SQL injection vulnerability in InterAKT MX Shop 1.1.1 allows remote attackers to execute arbitrary SQL commands via the idctg parameter...
CVE-2005-0956
CVE-2005-0956 : InterAKT MX Kart 1.1.2 has multiple SQL injection flaws in index.php, enabling remote attackers to alter/execute arbitrary SQL via the (1) idp, (2) id_ctg, or (3) id_man parameters. Root cause: unsafely interpolated user input in SQL queries. Impact: potential data disclosure/modi...
CVE-2005-0956
Multiple SQL injection vulnerabilities in index.php in InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via the 1 idp, 2 idctg, or 3 idman parameter...
CVE-2005-0955
InterAKT MX Shop 1.1.1 is affected by a SQL injection vulnerability via the id_ctg parameter, allowing remote attackers to execute arbitrary SQL commands. CVSSv2 base score 7.5 (NETWORK/LOW ATTACK COMPLEXITY, NO AUTHENTICATION). No remediation details are provided in the supplied documents; explo...
MX Shop 1.1.1 and MX Kart 1.1.2 are vulnerable to multiple SQL injection vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: Medium Title: MX Shop 1.1.1 and MX Kart 1.1.2 are vulnerable to multiple SQL injection vulnerabilities Date: 1/04/2005 Vendor: InterAKT Vendor...
security flaw
Postfix 2.1.3, when /proc/net/ifinet6 is not available and permitmxbackup is enabled in smtpdrecipientrestrictions, allows remote attackers to bypass e-mail restrictions and perform mail relaying by sending mail to an IPv6 hostname...
CVE-2004-2505
Macromedia ColdFusion MX before 6.1 does not restrict the size of error messages, which allows remote attackers to cause a denial of service memory consumption and crash by sending repeated GET or POST requests that trigger error messages that use long strings of data...
CVE-2004-1893
Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a...