1396 matches found
CVE-2002-1700: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability XSS in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message...
CVE-2005-1555
CVE-2005-1555 affects the JRun Web Server component of ColdFusion MX 7.0. The vulnerability is a cross-site scripting (XSS) flaw where an attacker can inject arbitrary script or HTML through the request URL because the URL is not properly quoted in the server’s default 404 error page. This is a c...
CVE-2005-1555: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page...
New Macromedia Security Zone Bulletin Posted
IMPORTANT: A new security bulletin describes a configuration problem that may affect ColdFusion installations. To learn about this new issue and what actions you can take to address it, please visit the Macromedia Security Zone: http://www.macromedia.com/go/mpsb05-03 MPSB05-03 ColdFusion MX 7...
CVE-2004-1893
CVE-2004-1893 affects Dreamweaver MX. The description states that when “Using Driver On Testing Server” or “Using DSN on Testing Server” is selected, mmhttpdb.asp is uploaded to the site without authentication, allowing remote attackers to obtain sensitive information and potentially execute arbi...
CVE-2005-1555
Cross-site scripting XSS vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page...
CVE-2004-1893
Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a...
CVE-2004-1815: Undefined Security Weakness
Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service memory consumption...
CVE-2004-1893: Undefined Security Weakness
Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a...
CVE-2005-0955
SQL injection vulnerability in InterAKT MX Shop 1.1.1 allows remote attackers to execute arbitrary SQL commands via the idctg parameter...
CVE-2005-0956
Multiple SQL injection vulnerabilities in index.php in InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via the 1 idp, 2 idctg, or 3 idman parameter...
CVE-2004-0928
The CVE-2004-0928 family affects Adobe JRun 4.x servers (and ColdFusion MX 6.0/6.1/J2EE) when running with IIS, where a crafted request ending in ";.cfm" can bypass authentication and disclose script/source content (e.g., .asp, .pl, .php). Connected advisories describe URL handling flaws that tri...
CVE-2004-0928
The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm"...
CVE-2004-0928: Undefined Security Weakness
The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm"...
ColdFusion < 7.0 MX File Disclosure
Binary data 2806.prm...
ColdFusion MX Server Detection (UDP)
Binary data 2804.prm...
Macromedia Security Bulletin - ColdFusion MX 6.1
MPSB05-02 - Workaround available for ColdFusion MX 6.1 Updater file disclosure. Originally posted: April 7, 2005 http://www.macromedia.com/go/mpsb05-02 Summary: ColdFusion 6.1 Updater 1 in the ColdFusion MX for JRun4 configuration only creates a /WEB-INF/cfclasses directory under the web server...
CVE-2005-0955
SQL injection vulnerability in InterAKT MX Shop 1.1.1 allows remote attackers to execute arbitrary SQL commands via the idctg parameter...
CVE-2005-0956
CVE-2005-0956 : InterAKT MX Kart 1.1.2 has multiple SQL injection flaws in index.php, enabling remote attackers to alter/execute arbitrary SQL via the (1) idp, (2) id_ctg, or (3) id_man parameters. Root cause: unsafely interpolated user input in SQL queries. Impact: potential data disclosure/modi...