CVSS: 4.3EPSS: 32%CPEs: 21EXPL: 5CVE-2009-1872 – Adobe ColdFusion Server 8.0.1 - '/wizards/common/_logintowizard.cfm' Query String Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1872
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion Server 8.0.1 y anteriores permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el parámetro (1) startRow para administrator/logviewer/searchlog.cfm o (2) mediante la cadena de petición para wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm o (4) administrator/enter.cfm. Adobe Coldfusion 8 suffers from cross site scripting and cross site request forgery vulnerabilities. • https://www.exploit-db.com/exploits/33169 https://www.exploit-db.com/exploits/33170 https://www.exploit-db.com/exploits/33167 https://www.exploit-db.com/exploits/33168 http://osvdb.org/57182 http://osvdb.org/57183 http://osvdb.org/57184 http://osvdb.org/57185 http://www.adobe.com/support/security/bulletins/apsb09-12.html http://www.dsecrg.com/pages/vul/show.php?id=122 http://www.securityfocus.com/archive/1/505803/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2008-0643
https://notcve.org/view.php?id=CVE-2008-0643
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion MX 7 y ColdFusion 8 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados. • http://secunia.com/advisories/29332 http://www.adobe.com/support/security/bulletins/apsb08-06.html http://www.securityfocus.com/bid/28205 http://www.securitytracker.com/id?1019589 http://www.vupen.com/english/advisories/2008/0862/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41144 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 4EXPL: 0CVE-2008-0644
https://notcve.org/view.php?id=CVE-2008-0644
Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding function. Adobe ColdFusion MX 7 y ColdFusion 8 permiten a atacantes remotos eludir el mecanismo de protección para aplicaciones contra secuencias de comandos en sitios cruzados (XSS) mediante vectores de ataque desconocidos relativos a la función setEncoding. • http://secunia.com/advisories/29332 http://www.adobe.com/support/security/bulletins/apsb08-07.html http://www.securityfocus.com/bid/28205 http://www.securitytracker.com/id?1019590 http://www.vupen.com/english/advisories/2008/0862/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41145 •
CVSS: 7.5EPSS: 2%CPEs: 2EXPL: 0CVE-2008-1203
https://notcve.org/view.php?id=CVE-2008-1203
The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection. El interfaz de administración para Adobe ColdFusion 8 y ColdFusion MX7 no registra los intentos de conexión fallidos, lo que provoca que que ataques de fuerza bruta de atacantes remotos no sean detectados. • http://secunia.com/advisories/29332 http://www.adobe.com/support/security/bulletins/apsb08-08.html http://www.securityfocus.com/bid/28207 http://www.securitytracker.com/id?1019600 http://www.vupen.com/english/advisories/2008/0862/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41150 •
CVSS: 6.8EPSS: 4%CPEs: 2EXPL: 0CVE-2007-5905
https://notcve.org/view.php?id=CVE-2007-5905
Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability. Adobe ColdFusion 8 y MX 7 permiten a atacantes remotos secuestrar sesiones mediante vectores no especificados que provocan el establecimiento de una sesión con una aplicación ColdFusion el la cual las cookies (1) CFID o (2) CFTOKEN tiene valores vacíos, posiblemente debido a una vulnerabilidad de fijación de sesión. • http://osvdb.org/41478 http://secunia.com/advisories/27644 http://securitytracker.com/id?1018944 http://www.adobe.com/go/kb402805 http://www.adobe.com/support/security/bulletins/apsb07-19.html http://www.securityfocus.com/bid/26429 http://www.vupen.com/english/advisories/2007/3859 https://exchange.xforce.ibmcloud.com/vulnerabilities/38446 • CWE-255: Credentials Management Errors •