CVE-2014-2868

CVE-2014-2868 affects PaperThin CommonSpot (before 7.0.2 and 8.x before 8.0.3). The issue allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable, as described in the CVE entries and Red Hat advisory references. Connecte...

CVE-2014-2860

Multiple cross-site scripting XSS vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a 1 ColdFusion or 2 JavaScript component...

CVE-2014-2871

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-2859

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request...

CVE-2014-2867

Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors...

CVE-2014-2859

CommonSpot (PaperThin) before 7.0.2 and 8.x before 8.0.3 is affected by CVE-2014-2859, which allows remote attackers to bypass intended access restrictions via a direct request. The connected sources confirm the affected versions and the access-bypass nature, but do not provide exploit code, conc...

CVE-2014-2874

CVE-2014-2874 affects PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3. The vulnerability allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context, i.e., a remote code execution flaw on the server. Root cause details are not elaborated in the prov...

CVE-2014-2863

CVE-2014-2863 describes multiple absolute path traversal vulnerabilities in PaperThin CommonSpot reported for versions before 7.0.2 and 8.x before 8.0.3. The flaw allows remote attackers to cause an unspecified impact by supplying a full pathname in a parameter. The connected documents corroborat...

CVE-2014-2862

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 contains improper authorization checks, allowing remote authenticated users to perform actions via unknown vectors. Affected software: CommonSpot. Root cause: missing/insufficient authorization in unspecified requests. Impact: unauthorized ac...

CVE-2014-2865

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation...

CVE-2014-2869

The provided data confirms CVE-2014-2869 affects PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3, where remote attackers can disclose sensitive information by requesting unspecified URIs. Impact details stated include exposure of pathname, SQL server information, e-mail addresses, and IP a...

CVE-2014-2874

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context...

CVE-2014-2868

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable...

CVE-2014-2864

Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences...

CVE-2010-0468

Cross-site scripting XSS vulnerability in utilities/longproc.cfm in PaperThin CommonSpot Content Server allows remote attackers to inject arbitrary web script or HTML via the url parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in utilities/longproc.cfm in PaperThin CommonSpot Content Server allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2010-0468

CVE-2010-0468 is a cross-site scripting (XSS) vulnerability in PaperThin CommonSpot Content Server, specifically in utilities/longproc.cfm, allowing remote attackers to inject arbitrary web script or HTML via the url parameter. The NVD entry describes the exposure but does not provide a documente...

CVE-2010-0468

Cross-site scripting XSS vulnerability in utilities/longproc.cfm in PaperThin CommonSpot Content Server allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2005-4575

PaperThin CommonSpot Content Server 4.5 and earlier allow remote attackers to obtain sensitive information via an invalid errmsg parameter to loader.cfm with a url parameter set to email-login-info.cfm, which leaks the full pathname in the resulting error message...

CVE-2005-4574

Cross-site scripting XSS vulnerability in loader.cfm in PaperThin CommonSpot Content Server 4.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the bNewWindow parameter...