CVSS: 7.5EPSS: 1%CPEs: 20EXPL: 0CVE-2009-1876
https://notcve.org/view.php?id=CVE-2009-1876
18 Aug 2009 — Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability." Adobe ColdFusion v8.0.1 y anteriores podrían permitir a atacantes obtener información sensible a través de vectores no especificado, esto es relativo a la "vulenrabilidad del caracter NU¨LL doblemente codificado". • http://osvdb.org/57189 •
CVSS: 6.1EPSS: 15%CPEs: 21EXPL: 5CVE-2009-1872 – Adobe ColdFusion Server 8.0.1 - '/wizards/common/_logintowizard.cfm' Query String Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1872
18 Aug 2009 — Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion Server 8.0.1 y anteriores permiten a... • https://www.exploit-db.com/exploits/33169 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2008-4831
https://notcve.org/view.php?id=CVE-2008-4831
10 Nov 2008 — Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive information or possibly gain privileges, via unknown vectors. Vulnerabilidad no especificada en Adobe ColdFusion v8 y v8.0.1 y ColdFusion MX v7.0.2; permite a usuarios locales evitar las restricciones de la caja de arena (sandbox) y obtener información sensible o posiblemente ganar privilegios a través de vectores desconocidos. • http://osvdb.org/49709 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 4%CPEs: 2EXPL: 0CVE-2008-1656
https://notcve.org/view.php?id=CVE-2008-1656
09 Apr 2008 — Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725. Adobe ColdFusion 8 and 8.0.1 no implementa adecuadamente el nivel de acceso público para los métodos CFC, lo cual permite a atacantes remotos invocar esos métodos a través de Flex 2 remotos, una vulnerabilidad distinta a CVE-2006-4725. • http://secunia.com/advisories/29748 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 0CVE-2008-0644
https://notcve.org/view.php?id=CVE-2008-0644
12 Mar 2008 — Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding function. Adobe ColdFusion MX 7 y ColdFusion 8 permiten a atacantes remotos eludir el mecanismo de protección para aplicaciones contra secuencias de comandos en sitios cruzados (XSS) mediante vectores de ataque desconocidos relativos a la función setEncoding. • http://secunia.com/advisories/29332 •
CVSS: 6.1EPSS: 2%CPEs: 4EXPL: 0CVE-2008-0643
https://notcve.org/view.php?id=CVE-2008-0643
12 Mar 2008 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion MX 7 y ColdFusion 8 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados. • http://secunia.com/advisories/29332 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 7%CPEs: 2EXPL: 0CVE-2008-1203
https://notcve.org/view.php?id=CVE-2008-1203
12 Mar 2008 — The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection. El interfaz de administración para Adobe ColdFusion 8 y ColdFusion MX7 no registra los intentos de conexión fallidos, lo que provoca que que ataques de fuerza bruta de atacantes remotos no sean detectados. • http://secunia.com/advisories/29332 •
CVSS: 9.1EPSS: 5%CPEs: 2EXPL: 0CVE-2007-5905
https://notcve.org/view.php?id=CVE-2007-5905
15 Nov 2007 — Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability. Adobe ColdFusion 8 y MX 7 permiten a atacantes remotos secuestrar sesiones mediante vectores no especificados que provocan el establecimiento de una sesión con una aplicación ColdFusion el la cual las cookies (1) CFID o (2) CFTOKEN tie... • http://osvdb.org/41478 • CWE-255: Credentials Management Errors •