Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
AdobeColdfusion7.0

26 matches found

CVE
CVE•added 2009/08/18 10:30 p.m.•65 views

CVE-2009-1872

Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (...

4.3CVSS5.7AI score0.12EPSS
CVE
CVE•added 2009/08/18 10:30 p.m.•56 views

CVE-2009-1876

Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."

5CVSS6.2AI score0.01476EPSS
CVE
CVE•added 2006/12/12 8:28 p.m.•54 views

CVE-2006-6483

Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script" in a tag.

2.6CVSS5.6AI score0.0239EPSS
CVE
CVE•added 2006/10/10 10:7 p.m.•49 views

CVE-2006-3978

Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary code via unknown attack vectors.

4.6CVSS7.6AI score0.00403EPSS
CVE
CVE•added 2007/02/14 2:28 a.m.•48 views

CVE-2006-5860

Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

4.3CVSS5.6AI score0.02328EPSS
CVE
CVE•added 2008/03/12 12:44 a.m.•48 views

CVE-2008-0644

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding function.

5CVSS5.9AI score0.01883EPSS
CVE
CVE•added 2010/05/13 5:30 p.m.•46 views

CVE-2010-1293

Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00816EPSS
CVE
CVE•added 2009/08/18 10:30 p.m.•44 views

CVE-2009-1875

Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1877.

4.3CVSS5.7AI score0.00667EPSS
CVE
CVE•added 2006/12/12 8:28 p.m.•43 views

CVE-2006-6482

Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can ...

5CVSS6.5AI score0.01537EPSS
CVE
CVE•added 2007/11/15 8:46 p.m.•43 views

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability.

6.8CVSS6.7AI score0.0543EPSS
CVE
CVE•added 2006/09/14 12:7 a.m.•42 views

CVE-2006-4726

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page.

2.6CVSS5.8AI score0.02039EPSS
CVE
CVE•added 2007/03/16 8:19 p.m.•42 views

CVE-2007-1278

Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root.

4.3CVSS6.6AI score0.04573EPSS
CVE
CVE•added 2011/02/01 6:0 p.m.•42 views

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-w...

5.3CVSS6.3AI score0.00816EPSS
CVE
CVE•added 2008/03/12 12:44 a.m.•41 views

CVE-2008-0643

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.7AI score0.02799EPSS
CVE
CVE•added 2010/05/13 5:30 p.m.•41 views

CVE-2009-3467

Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

4.3CVSS5.8AI score0.00816EPSS
CVE
CVE•added 2011/02/01 6:0 p.m.•41 views

CVE-2011-0735

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."

4.3CVSS5.7AI score0.00603EPSS
CVE
CVE•added 2011/02/01 6:0 p.m.•41 views

CVE-2011-0737

Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Se...

5.3CVSS6.3AI score0.00891EPSS
CVE
CVE•added 2007/04/11 10:19 p.m.•40 views

CVE-2007-1874

Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4...

7.2CVSS7AI score0.00172EPSS
CVE
CVE•added 2011/02/01 6:0 p.m.•40 views

CVE-2011-0734

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as af...

4.3CVSS5.8AI score0.00791EPSS
CVE
CVE•added 2006/09/14 12:7 a.m.•39 views

CVE-2006-4725

Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templates that are located outside of the sandbox.

4.6CVSS6.3AI score0.00254EPSS
CVE
CVE•added 2009/08/18 10:30 p.m.•39 views

CVE-2009-1877

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1875.

4.3CVSS5.7AI score0.00667EPSS
CVE
CVE•added 2009/08/18 10:30 p.m.•38 views

CVE-2009-1878

Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

5.8CVSS6.8AI score0.00284EPSS
CVE
CVE•added 2006/09/14 12:7 a.m.•36 views

CVE-2006-4724

Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors involving a crafted command.

5CVSS7AI score0.01973EPSS
CVE
CVE•added 2010/05/13 5:30 p.m.•36 views

CVE-2010-1294

Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors.

2.1CVSS5.8AI score0.00153EPSS
CVE
CVE•added 2008/03/12 12:44 a.m.•35 views

CVE-2008-1203

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.

7.5CVSS6.8AI score0.07438EPSS
CVE
CVE•added 2007/02/14 1:28 a.m.•33 views

CVE-2006-5859

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm.

4.3CVSS5.8AI score0.02799EPSS