CVSS: 5.4EPSS: 0%CPEs: 10EXPL: 0CVE-2013-5326
https://notcve.org/view.php?id=CVE-2013-5326
13 Nov 2013 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory is available, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the logviewer directory. Una vulnerabilidad de tipo cross-site scripting (XSS) en Adobe ColdFusion versión 9.0 anterior a Update 12, versión 9.0.1 anterior a Update 11, versión 9.0.2 anterior a Update 6 y versi... • http://www.adobe.com/support/security/bulletins/apsb13-27.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2013-5328
https://notcve.org/view.php?id=CVE-2013-5328
13 Nov 2013 — Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors. Adobe ColdFusion 10 anterior a Update 12 permite a atacantes remotos leer ficheros arbitrarios a través de vectores sin especificar • http://www.adobe.com/support/security/bulletins/apsb13-27.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2010-5290
https://notcve.org/view.php?id=CVE-2010-5290
20 Sep 2013 — The authentication process in Adobe ColdFusion before 10 does not require knowledge of the cleartext password if the password hash is known, which makes it easier for context-dependent attackers to obtain administrative privileges by leveraging read access to the configuration file, a different vulnerability than CVE-2010-2861. El proceso de autenticación en Adobe ColdFusion anteriores a v10 no requiere conocimiento de la contraseña en claro si el hash de la contraseña es conocido, lo cual facilita a atacan... • http://osvdb.org/97553 • CWE-255: Credentials Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2012-2048
https://notcve.org/view.php?id=CVE-2012-2048
12 Sep 2012 — Unspecified vulnerability in Adobe ColdFusion 10 and earlier allows attackers to cause a denial of service via unknown vectors. Vulnerabilidad no especificada en Adobe ColdFusion 10 y anteriores permite a atacantes provocar una denegación de servicio a través de vectores desconocidos. • http://osvdb.org/85317 •
CVSS: 5.3EPSS: 1%CPEs: 13EXPL: 2CVE-2011-0737
https://notcve.org/view.php?id=CVE-2011-0737
01 Feb 2011 — Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure ** DISPUTADA ** Adobe ColdFusion 9.0.1 CHF1 y anteriores permite a atacantes remotos o... • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 1%CPEs: 13EXPL: 2CVE-2011-0736
https://notcve.org/view.php?id=CVE-2011-0736
01 Feb 2011 — Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure ** DISPUTADA ** Adobe ColdFusion 9.0.1 CHF1 y ant... • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 59%CPEs: 13EXPL: 2CVE-2011-0735
https://notcve.org/view.php?id=CVE-2011-0735
01 Feb 2011 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion before v9.0.1 CHF1 permite a atacantes remotos ejecutar código web o HTML de su elección a través de vectores relacionados con una "secuencia de comandos de etiquetas" • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 4%CPEs: 13EXPL: 3CVE-2011-0734
https://notcve.org/view.php?id=CVE-2011-0734
01 Feb 2011 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion v9.0.1 CHF1 y anteriores permite a atacantes remotos inyectar secuencias de comand... • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 95%CPEs: 4EXPL: 3CVE-2010-2861 – Adobe ColdFusion Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2010-2861
11 Aug 2010 — Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/. Múltiples vulnerabilidades de salto de directorio en la consola del administrador en ColdFusion de Adobe versión 9.0.1 y anteriores, permiten a los... • https://packetstorm.news/files/id/181055 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2010-1294
https://notcve.org/view.php?id=CVE-2010-1294
13 May 2010 — Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors. Vulnerabilidad no especificada en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a usuarios locales obtener información sensible mediante vectores desconocidos. • http://secunia.com/advisories/39790 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •