CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2011-0584
https://notcve.org/view.php?id=CVE-2011-0584
Session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de fijación de sesión en Adobe Coldfusión v8.0 a la 9.0.1, permite a atacantes remotos secuestrar sesiones web a través de vectores no especificados. • http://secunia.com/advisories/43264 http://www.adobe.com/support/security/bulletins/apsb11-04.html http://www.securityfocus.com/bid/46278 http://www.securitytracker.com/id?1025036 http://www.vupen.com/english/advisories/2011/0334 https://exchange.xforce.ibmcloud.com/vulnerabilities/65280 •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2011-0582
https://notcve.org/view.php?id=CVE-2011-0582
Unspecified vulnerability in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allows attackers to obtain sensitive information via unknown vectors. Vulnerabilidad no especificada en la consola del administrador en Adobe ColdFusion v8.0 a v9.0.1 permite a atacantes obtener información sensible a través de vectores desconocidos. • http://secunia.com/advisories/43264 http://www.adobe.com/support/security/bulletins/apsb11-04.html http://www.securityfocus.com/bid/46274 http://www.securitytracker.com/id?1025036 http://www.vupen.com/english/advisories/2011/0334 https://exchange.xforce.ibmcloud.com/vulnerabilities/65278 •
CVSS: 5.3EPSS: 0%CPEs: 13EXPL: 2CVE-2011-0737
https://notcve.org/view.php?id=CVE-2011-0737
Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure ** DISPUTADA ** Adobe ColdFusion 9.0.1 CHF1 y anteriores permite a atacantes remotos obtener información sensible a través de una consulta id=- a un fichero .cfm, lo que revela la ruta de instalación en un mensaje de error. NOTA: El proveedor disputa el significado de este problema porque las secciones Site-wide Error Handler y Debug Output Settings de la guía ColdFusion Lockdown explican el requisito para las configuraciones que evitan la divulgación de esta información. • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html http://osvdb.org/70781 http://websecurity.com.ua/4879 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 2CVE-2011-0736
https://notcve.org/view.php?id=CVE-2011-0736
Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure ** DISPUTADA ** Adobe ColdFusion 9.0.1 CHF1 y anteriores, cunado una aplicación web está configurada para utilizar un DBMS, permite a atacantes remotos obtener información potencialmente sensible acerca de la estructura de la base de datos a través de una consulta id=- a un fichero .cfm. NOTA: El proveedor disputa la importancia de este problema porque las secciones Site-wide Error Handler y Debug Output Settings de la guía ColdFusion Lockdown explican el requisito para las configuraciones que previenen esta divulgación de información. • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html http://osvdb.org/70780 http://websecurity.com.ua/4879 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 2%CPEs: 13EXPL: 3CVE-2011-0734
https://notcve.org/view.php?id=CVE-2011-0734
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion v9.0.1 CHF1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un parámetro id que contiene un controlador de evento onLoad de JavaScript para un elemento BODY, relacionado con un ataque de "etiqueta body". • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html http://kb2.adobe.com/cps/890/cpsid_89094.html http://osvdb.org/70778 http://securitytracker.com/id?1025012 http://websecurity.com.ua/4879 http://www.adobe.com/support/security/bulletins/apsb11-04.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •