Page 11 of 149 results (0.012 seconds)

CVSS: 10.0EPSS: 88%CPEs: 39EXPL: 2

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution. Adobe ColdFusion 2016 Update 3 y anteriores, ColdFusion 11 update 11 y anteriores, ColdFusion 10 Update 22 y anteriores tienen una vulnerabilidad de deserialización de Java en la librería Apache BlazeDS. Una explotación exitosa podría conducir a la ejecución arbitraria de código. • https://www.exploit-db.com/exploits/43993 https://github.com/cucadili/CVE-2017-3066 http://www.securityfocus.com/bid/98003 http://www.securitytracker.com/id/1038364 https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html • CWE-502: Deserialization of Untrusted Data •

CVSS: 8.6EPSS: 78%CPEs: 2EXPL: 2

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. La funcionalidad Office Open XML (OOXML) en Adobe ColdFusion 10 en versiones anteriores a Update 21 y 11 en versiones anteriores a Update 10 permite a atacantes remotos leer archivos arbitrarios o enviar peticiones TCP a servidores de intranet a través de una hoja de cálculo OOXML manipulada que contiene una declaración de entidad externa en conjunción con una referencia de entidad, relacionado con un problema XML External Entity (XXE). Adobe ColdFusion versions 11 and below suffer from an XML external entity (XXE) injection vulnerability. • https://www.exploit-db.com/exploits/40346 http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt http://www.securityfocus.com/archive/1/539374/100/0/threaded http://www.securityfocus.com/bid/92684 http://www.securitytracker.com/id/1036708 https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 6.1EPSS: 0%CPEs: 31EXPL: 0

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 20, 11 en versiones anteriores a Update 9 y 2016 en versiones anteriores a Update 2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.securitytracker.com/id/1036098 https://helpx.adobe.com/security/products/coldfusion/apsb16-22.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.9EPSS: 0%CPEs: 28EXPL: 0

Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate. Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 no maneja correctamente comodines en campos name de certificados X.509, lo que podría permitir a atacantes man-in-the-middle suplantar servidoresservers a través de un certificado manipulado. • http://www.securityfocus.com/bid/90514 http://www.securitytracker.com/id/1035829 https://helpx.adobe.com/security/products/coldfusion/apsb16-16.html • CWE-20: Improper Input Validation •

CVSS: 6.1EPSS: 1%CPEs: 28EXPL: 0

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.securityfocus.com/bid/90507 http://www.securitytracker.com/id/1035829 https://helpx.adobe.com/security/products/coldfusion/apsb16-16.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •