CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 2CVE-2011-0736
https://notcve.org/view.php?id=CVE-2011-0736
Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure ** DISPUTADA ** Adobe ColdFusion 9.0.1 CHF1 y anteriores, cunado una aplicación web está configurada para utilizar un DBMS, permite a atacantes remotos obtener información potencialmente sensible acerca de la estructura de la base de datos a través de una consulta id=- a un fichero .cfm. NOTA: El proveedor disputa la importancia de este problema porque las secciones Site-wide Error Handler y Debug Output Settings de la guía ColdFusion Lockdown explican el requisito para las configuraciones que previenen esta divulgación de información. • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html http://osvdb.org/70780 http://websecurity.com.ua/4879 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 96%CPEs: 4EXPL: 2CVE-2010-2861 – Adobe ColdFusion Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2010-2861
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/. Múltiples vulnerabilidades de salto de directorio en la consola del administrador en ColdFusion de Adobe versión 9.0.1 y anteriores, permiten a los atacantes remotos leer archivos arbitrarios por medio del parámetro locale en los archivos (1) CFIDE/administrador/configuración/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm y (5) enter.cfm en CFIDE/administrador/. A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files. • https://www.exploit-db.com/exploits/16985 https://www.exploit-db.com/exploits/14641 http://securityreason.com/securityalert/8137 http://securityreason.com/securityalert/8148 http://www.adobe.com/support/security/bulletins/apsb10-18.html http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 10%CPEs: 11EXPL: 0CVE-2009-3467
https://notcve.org/view.php?id=CVE-2009-3467
Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en un método no especificado en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores desconocidos. • http://secunia.com/advisories/39790 http://www.adobe.com/support/security/bulletins/apsb10-11.html http://www.vupen.com/english/advisories/2010/1127 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 10%CPEs: 11EXPL: 0CVE-2010-1293
https://notcve.org/view.php?id=CVE-2010-1293
Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la página de Administración en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados . • http://secunia.com/advisories/39790 http://www.adobe.com/support/security/bulletins/apsb10-11.html http://www.vupen.com/english/advisories/2010/1127 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 11EXPL: 0CVE-2010-1294
https://notcve.org/view.php?id=CVE-2010-1294
Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors. Vulnerabilidad no especificada en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a usuarios locales obtener información sensible mediante vectores desconocidos. • http://secunia.com/advisories/39790 http://www.adobe.com/support/security/bulletins/apsb10-11.html http://www.vupen.com/english/advisories/2010/1127 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •