CVSS: 4.3EPSS: 10%CPEs: 11EXPL: 0CVE-2010-1293
https://notcve.org/view.php?id=CVE-2010-1293
Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la página de Administración en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados . • http://secunia.com/advisories/39790 http://www.adobe.com/support/security/bulletins/apsb10-11.html http://www.vupen.com/english/advisories/2010/1127 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 11EXPL: 0CVE-2010-1294
https://notcve.org/view.php?id=CVE-2010-1294
Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors. Vulnerabilidad no especificada en Adobe ColdFusion 8.0, 8.0.1 y 9.0 permite a usuarios locales obtener información sensible mediante vectores desconocidos. • http://secunia.com/advisories/39790 http://www.adobe.com/support/security/bulletins/apsb10-11.html http://www.vupen.com/english/advisories/2010/1127 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 94%CPEs: 12EXPL: 2CVE-2009-3960 – Adobe BlazeDS Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2009-3960
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents. Vulnerabilidad sin especificar en BlazeDS v3.2 y anteriores, tal como es utilizado en LiveCycle v8.0.1, v8.2.1 y v9.0, LiveCycle Data Services v2.5.1, v2.6.1 y v3.0, Flex Data Services v2.0.1 y ColdFusion v7.0.2, v8.0, v8.0.1 y v9.0. Permite a atacantes remotos obtener información confidencial a través de vectores de ataque asociados con una petición, y relacionados con una etiqueta inyectada y una referencia a una entidad externa en documentos XML. Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2. • https://www.exploit-db.com/exploits/11529 https://www.exploit-db.com/exploits/41855 http://secunia.com/advisories/38543 http://securitytracker.com/id?1023584 http://www.adobe.com/support/security/bulletins/apsb10-05.html http://www.osvdb.org/62292 http://www.securityfocus.com/bid/38197 •
CVSS: 5.8EPSS: 16%CPEs: 21EXPL: 0CVE-2009-1878
https://notcve.org/view.php?id=CVE-2009-1878
Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de fijación de sesión en Adobe ColdFusion v8.0.1 y versiones anteriores, que permite a los atacantes remotos, secuestrar una sesión web a través de vectores no especificados. • http://osvdb.org/57191 http://www.adobe.com/support/security/bulletins/apsb09-12.html • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 20%CPEs: 20EXPL: 0CVE-2009-1876
https://notcve.org/view.php?id=CVE-2009-1876
Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability." Adobe ColdFusion v8.0.1 y anteriores podrían permitir a atacantes obtener información sensible a través de vectores no especificado, esto es relativo a la "vulenrabilidad del caracter NU¨LL doblemente codificado". • http://osvdb.org/57189 http://www.adobe.com/support/security/bulletins/apsb09-12.html •