CVSS: 9.8EPSS: 0%CPEs: 28EXPL: 0CVE-2016-1114
https://notcve.org/view.php?id=CVE-2016-1114
11 May 2016 — Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library. Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 permite a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado, relacionado con la librería Apache Commo... • http://www.securityfocus.com/bid/90506 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.9EPSS: 0%CPEs: 28EXPL: 0CVE-2016-1115
https://notcve.org/view.php?id=CVE-2016-1115
11 May 2016 — Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate. Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 no maneja correctamente comodines en campos name de certificados X.509, lo que podría permitir a atacantes man-in-the-middle suplantar servidor... • http://www.securityfocus.com/bid/90514 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 3%CPEs: 2EXPL: 0CVE-2015-8052
https://notcve.org/view.php?id=CVE-2015-8052
18 Nov 2015 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 18 y 11 en versiones anteriores a Update 7 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a ... • http://www.securityfocus.com/bid/77625 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 3%CPEs: 2EXPL: 0CVE-2015-8053
https://notcve.org/view.php?id=CVE-2015-8053
18 Nov 2015 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052. Vulnerabilidad de XSS en Adobe ColdFusion 10 en versiones anteriores a Update 18 y 11 en versiones anteriores a Update 7 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a ... • http://www.securityfocus.com/bid/77625 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 1CVE-2015-5255 – HP Security Bulletin HPSBST03568 1
https://notcve.org/view.php?id=CVE-2015-5255
18 Nov 2015 — Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue. Adobe BlazeDS, como se utiliza en ColdFusion 10 en versiones anteriores a Update 18 y 11 en versiones anteriores a ... • https://packetstorm.news/files/id/134506 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 2%CPEs: 2EXPL: 1CVE-2015-0345
https://notcve.org/view.php?id=CVE-2015-0345
15 Apr 2015 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Adobe ColdFusion 10 anterior a Update 16 y 11 anterior a Update 5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • https://github.com/BishopFox/coldfusion-10-11-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2014-9166
https://notcve.org/view.php?id=CVE-2014-9166
10 Dec 2014 — Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service (resource consumption) via unspecified vectors. Adobe ColdFusion 10 anterior a Update 15 y 11 anterior a Update 3 permite a atacantes causar una denegación de servicio (consumo de recursos) a través de vectores no especificados. • http://helpx.adobe.com/security/products/coldfusion/apsb14-29.html •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2014-0572
https://notcve.org/view.php?id=CVE-2014-0572
15 Oct 2014 — Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors. Adobe ColdFusion 9.0 anterior a Update 13, 9.0.1 anterior a Update 12, 9.0.2 anterior a Update 7, 10 anterior a Update 14, y 11 anterior a Update 2 permite a usuarios locales evadir las restricciones de acceso basadas en IP a través de vectores no especificados. • http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2014-0570
https://notcve.org/view.php?id=CVE-2014-0570
15 Oct 2014 — Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad de CSRF en Adobe ColdFusion 9.0 anterior a Update 13, 9.0.1 anterior a Update 12, 9.0.2 anterior a Update 7, 10 anterior a Update 14, y 11 anterior a Update 2 permite a atacantes remotos secuestrar la autenticación de v... • http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 2%CPEs: 18EXPL: 0CVE-2014-0571
https://notcve.org/view.php?id=CVE-2014-0571
15 Oct 2014 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Adobe ColdFusion 9.0 anterior a Update 13, 9.0.1 antterior a Update 12, 9.0.2 anterior a Update 7, 10 anterior a Update 14, y 11 anterior a Update 2 permite a atacantes remotos inyectar secuencias de comandos remotos a través... • http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •