Page 10 of 190 results (0.008 seconds)

CVSS: 6.1EPSS: 1%CPEs: 39EXPL: 0

CVE-2017-3008

https://notcve.org/view.php?id=CVE-2017-3008

27 Apr 2017 — Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability. Adobe ColdFusion 2016 Update 3 y anteriores, ColdFusion 11 update 11 y anteriores, ColdFusion 10 Update 22 y versiones anteriores tienen una vulnerabilidad de cross-site scripting. • http://www.securityfocus.com/bid/98002 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 10.0EPSS: 93%CPEs: 39EXPL: 4

CVE-2017-3066 – Adobe ColdFusion Deserialization Vulnerability

https://notcve.org/view.php?id=CVE-2017-3066

27 Apr 2017 — Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution. Adobe ColdFusion 2016 Update 3 y anteriores, ColdFusion 11 update 11 y anteriores, ColdFusion 10 Update 22 y anteriores tienen una vulnerabilidad de deserialización de Java en la librería Apache BlazeDS. Una explotación exitosa podría conducir a la ejecución... • https://packetstorm.news/files/id/146285 • CWE-502: Deserialization of Untrusted Data •

CVSS: 8.6EPSS: 55%CPEs: 2EXPL: 3

CVE-2016-4264 – Adobe ColdFusion < 11 Update 10 - XML External Entity Injection

https://notcve.org/view.php?id=CVE-2016-4264

01 Sep 2016 — The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. La funcionalidad Office Open XML (OOXML) en Adobe ColdFusion 10 en versiones anteriores a Update 21 y 11 en versiones anteriores a Update 10 permite a atacantes ... • https://packetstorm.news/files/id/138621 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 6.1EPSS: 0%CPEs: 31EXPL: 0

CVE-2016-4159

https://notcve.org/view.php?id=CVE-2016-4159

16 Jun 2016 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 20, 11 en versiones anteriores a Update 9 y 2016 en versiones anteriores a Update 2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.securitytracker.com/id/1036098 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 28EXPL: 0

CVE-2016-1113

https://notcve.org/view.php?id=CVE-2016-1113

11 May 2016 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.securityfocus.com/bid/90507 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 2%CPEs: 28EXPL: 0

CVE-2016-1114

https://notcve.org/view.php?id=CVE-2016-1114

11 May 2016 — Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library. Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 permite a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado, relacionado con la librería Apache Commo... • http://www.securityfocus.com/bid/90506 • CWE-502: Deserialization of Untrusted Data •

CVSS: 5.9EPSS: 0%CPEs: 28EXPL: 0

CVE-2016-1115

https://notcve.org/view.php?id=CVE-2016-1115

11 May 2016 — Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate. Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 no maneja correctamente comodines en campos name de certificados X.509, lo que podría permitir a atacantes man-in-the-middle suplantar servidor... • http://www.securityfocus.com/bid/90514 • CWE-20: Improper Input Validation •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2015-8052

https://notcve.org/view.php?id=CVE-2015-8052

18 Nov 2015 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 18 y 11 en versiones anteriores a Update 7 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a ... • http://www.securityfocus.com/bid/77625 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2015-8053

https://notcve.org/view.php?id=CVE-2015-8053

18 Nov 2015 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 18 y 11 en versiones anteriores a Update 7 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a ... • http://www.securityfocus.com/bid/77625 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 1%CPEs: 8EXPL: 1

CVE-2015-5255 – HP Security Bulletin HPSBST03568 1

https://notcve.org/view.php?id=CVE-2015-5255

18 Nov 2015 — Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue. Adobe BlazeDS, como se utiliza en ColdFusion 10 en versiones anteriores a Update 18 y 11 en versiones anteriores a ... • https://packetstorm.news/files/id/134506 • CWE-20: Improper Input Validation •