CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2011-0584
https://notcve.org/view.php?id=CVE-2011-0584
10 Feb 2011 — Session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de fijación de sesión en Adobe Coldfusión v8.0 a la 9.0.1, permite a atacantes remotos secuestrar sesiones web a través de vectores no especificados. • http://secunia.com/advisories/43264 •
CVSS: 5.3EPSS: 1%CPEs: 13EXPL: 2CVE-2011-0737
https://notcve.org/view.php?id=CVE-2011-0737
01 Feb 2011 — Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure ** DISPUTADA ** Adobe ColdFusion 9.0.1 CHF1 y anteriores permite a atacantes remotos o... • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 1%CPEs: 13EXPL: 2CVE-2011-0736
https://notcve.org/view.php?id=CVE-2011-0736
01 Feb 2011 — Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure ** DISPUTADA ** Adobe ColdFusion 9.0.1 CHF1 y ant... • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 59%CPEs: 13EXPL: 2CVE-2011-0735
https://notcve.org/view.php?id=CVE-2011-0735
01 Feb 2011 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion before v9.0.1 CHF1 permite a atacantes remotos ejecutar código web o HTML de su elección a través de vectores relacionados con una "secuencia de comandos de etiquetas" • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 4%CPEs: 13EXPL: 3CVE-2011-0734
https://notcve.org/view.php?id=CVE-2011-0734
01 Feb 2011 — Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Adobe ColdFusion v9.0.1 CHF1 y anteriores permite a atacantes remotos inyectar secuencias de comand... • http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 95%CPEs: 4EXPL: 3CVE-2010-2861 – Adobe ColdFusion Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2010-2861
11 Aug 2010 — Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/. Múltiples vulnerabilidades de salto de directorio en la consola del administrador en ColdFusion de Adobe versión 9.0.1 y anteriores, permiten a los... • https://packetstorm.news/files/id/181055 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2010-1294
https://notcve.org/view.php?id=CVE-2010-1294
13 May 2010 — Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors. Vulnerabilidad no especificada en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a usuarios locales obtener información sensible mediante vectores desconocidos. • http://secunia.com/advisories/39790 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 3%CPEs: 11EXPL: 0CVE-2010-1293
https://notcve.org/view.php?id=CVE-2010-1293
13 May 2010 — Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la página de Administración en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados . • http://secunia.com/advisories/39790 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 3%CPEs: 11EXPL: 0CVE-2009-3467
https://notcve.org/view.php?id=CVE-2009-3467
13 May 2010 — Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en un método no especificado en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores desconocidos. • http://secunia.com/advisories/39790 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 93%CPEs: 12EXPL: 4CVE-2009-3960 – Adobe BlazeDS Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2009-3960
15 Feb 2010 — Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents. Vulnerabilidad sin especificar en BlazeDS v3.2 y anteriores, tal como es utilizado en LiveCycle v8.0.1, v8.2.1 y v9.... • https://packetstorm.news/files/id/181095 •