Vulnerabilites related to adobe - jrun
var-200703-0122
Vulnerability from variot
Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root. Adobe JRun and ColdFusion MX of IIS Connector has a service disruption (DoS) There is a vulnerability that becomes a condition.Service disruption by a third party (DoS) There is a possibility of being put into a state. Adobe JRun is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. This issue affects Microsoft IIS 6 installations running JRun 4 Updater 6.
Want a new job? http://secunia.com/secunia_vacancies/
Secunia is looking for new researchers with a reversing background and experience in writing exploit code: http://secunia.com/hardcore_disassembler_and_reverse_engineer/ http://secunia.com/Disassembling_og_Reversing/
TITLE: Adobe JRun IIS 6 Connector Denial of Service
SECUNIA ADVISORY ID: SA24488
VERIFY ADVISORY: http://secunia.com/advisories/24488/
CRITICAL: Moderately critical
IMPACT: DoS
WHERE:
From remote
SOFTWARE: Adobe ColdFusion MX 7.x http://secunia.com/product/4984/ Macromedia ColdFusion MX 6.x http://secunia.com/product/864/ Macromedia Jrun 4.x http://secunia.com/product/863/
DESCRIPTION: A vulnerability has been reported in Adobe JRun, which potentially can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error within JRun\x92s IIS connector when handling certain requests for resources. This can be exploited via e.g. requesting a file within the web root and then performing certain actions.
The vulnerability is reported in the following products with IIS 6: * JRun 4 Updater 6 * Adobe ColdFusion MX 7.0 Enterprise Edition, if installed as the "Multi-Server" option * Adobe ColdFusion MX 6.1 Enterprise, if installed with the "J2EE" option and deployed on JRun 4.0 Updater 6
Adobe ColdFusion MX 6.1 and 7.0 Standard editions are not affected by this issue.
SOLUTION: Apply hotfix (see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY: The vendor credits Shoji Kamiichi, NEC.
ORIGINAL ADVISORY: Adobe: http://www.adobe.com/support/security/bulletins/apsb07-07.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200703-0122",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "coldfusion",
"scope": "eq",
"trust": 1.0,
"vendor": "adobe",
"version": "6.1"
},
{
"model": "jrun",
"scope": "eq",
"trust": 1.0,
"vendor": "adobe",
"version": "4.0"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 1.0,
"vendor": "adobe",
"version": "7.0"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "mx mx 6.1 and 7.0 enterprise"
},
{
"model": "jrun",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.0 updater 6"
},
{
"model": "iis",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "6"
},
{
"model": "iis",
"scope": "eq",
"trust": 0.6,
"vendor": "microsoft",
"version": "6.0"
},
{
"model": "jrun updater",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "4.06"
},
{
"model": "coldfusion mx enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "7.0"
},
{
"model": "coldfusion mx enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "6.1"
}
],
"sources": [
{
"db": "BID",
"id": "22958"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
},
{
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:adobe:coldfusion",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:adobe:jrun",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:microsoft:iis",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Shoji Kamiichi",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
}
],
"trust": 0.6
},
"cve": "CVE-2007-1278",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2007-1278",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-1278",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2007-1278",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200703-412",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
},
{
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root. Adobe JRun and ColdFusion MX of IIS Connector has a service disruption (DoS) There is a vulnerability that becomes a condition.Service disruption by a third party (DoS) There is a possibility of being put into a state. Adobe JRun is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions. \nAn attacker can exploit this issue to crash the affected application, denying service to legitimate users. \nThis issue affects Microsoft IIS 6 installations running JRun 4 Updater 6. \n\n----------------------------------------------------------------------\n\nWant a new job?\nhttp://secunia.com/secunia_vacancies/\n\nSecunia is looking for new researchers with a reversing background\nand experience in writing exploit code:\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\nhttp://secunia.com/Disassembling_og_Reversing/\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe JRun IIS 6 Connector Denial of Service\n\nSECUNIA ADVISORY ID:\nSA24488\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/24488/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nAdobe ColdFusion MX 7.x\nhttp://secunia.com/product/4984/\nMacromedia ColdFusion MX 6.x\nhttp://secunia.com/product/864/\nMacromedia Jrun 4.x\nhttp://secunia.com/product/863/\n\nDESCRIPTION:\nA vulnerability has been reported in Adobe JRun, which potentially\ncan be exploited by malicious people to cause a DoS (Denial of\nService). \n\nThe vulnerability is caused due to an error within JRun\\x92s IIS\nconnector when handling certain requests for resources. This can be\nexploited via e.g. requesting a file within the web root and then\nperforming certain actions. \n\nThe vulnerability is reported in the following products with IIS 6:\n* JRun 4 Updater 6\n* Adobe ColdFusion MX 7.0 Enterprise Edition, if installed as the\n\"Multi-Server\" option\n* Adobe ColdFusion MX 6.1 Enterprise, if installed with the \"J2EE\"\noption and deployed on JRun 4.0 Updater 6\n\nAdobe ColdFusion MX 6.1 and 7.0 Standard editions are not affected by\nthis issue. \n\nSOLUTION:\nApply hotfix (see the vendor\u0027s advisory for details). \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Shoji Kamiichi, NEC. \n\nORIGINAL ADVISORY:\nAdobe:\nhttp://www.adobe.com/support/security/bulletins/apsb07-07.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1278"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "BID",
"id": "22958"
},
{
"db": "PACKETSTORM",
"id": "55081"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-1278",
"trust": 2.7
},
{
"db": "BID",
"id": "22958",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "24488",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2007-0932",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1017752",
"trust": 1.6
},
{
"db": "OSVDB",
"id": "34039",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001655",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200703-412",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "55081",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "22958"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "PACKETSTORM",
"id": "55081"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
},
{
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"id": "VAR-200703-0122",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-11-23T23:13:20.402000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB07-07",
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb07-07.html"
},
{
"title": "Microsoft IIS",
"trust": 0.8,
"url": "http://www.iis.net/"
},
{
"title": "Adobe ColdFusion and Adobe JRun IIS connector Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=94516"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.adobe.com/support/security/bulletins/apsb07-07.html"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32994"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/24488"
},
{
"trust": 1.6,
"url": "http://www.vupen.com/english/advisories/2007/0932"
},
{
"trust": 1.6,
"url": "http://osvdb.org/34039"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id?1017752"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/22958"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1278"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1278"
},
{
"trust": 0.3,
"url": "http://www.adobe.com"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/864/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/24488/"
},
{
"trust": 0.1,
"url": "http://secunia.com/disassembling_og_reversing/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4984/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/863/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "BID",
"id": "22958"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "PACKETSTORM",
"id": "55081"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
},
{
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "22958"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"db": "PACKETSTORM",
"id": "55081"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
},
{
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-13T00:00:00",
"db": "BID",
"id": "22958"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"date": "2007-03-17T02:22:27",
"db": "PACKETSTORM",
"id": "55081"
},
{
"date": "2007-03-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-412"
},
{
"date": "2007-03-16T20:19:00",
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-14T20:04:00",
"db": "BID",
"id": "22958"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001655"
},
{
"date": "2019-07-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-412"
},
{
"date": "2024-11-21T00:27:56.350000",
"db": "NVD",
"id": "CVE-2007-1278"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe JRun and ColdFusion MX of IIS Service disruption in connectors (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001655"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-412"
}
],
"trust": 0.6
}
}
var-200612-0480
Vulnerability from variot
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file. Adobe Download Manager contains a buffer overflow. This vulnerability may allow a remote, unauthenticated attacker to run arbitrary code with the privileges of the affected user or cause a denial-of-service condition. Adobe ColdFusion is prone to an information-disclosure vulnerability. Successfully exploiting this issue allows remote attackers to gain access to the contents of arbitrary files that are not interpreted by ColdFusion. This includes the source of scripting files not handled by ColdFusion, configuration files, log files, and other data files. Information harvested may aid attackers in further attacks. Adobe ColdFusion MX7, 7.0.1 and 7.0.2 are vulnerable.
Secunia is proud to announce the availability of the Secunia Software Inspector.
The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. ".cfm". Other versions may also be affected.
SOLUTION: Apply hotfix (See vendor's advisory for details). Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability
iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007
I. BACKGROUND
Adobe Macromedia ColdFusion is an application server and development framework for websites. More information is available at the following URL.
http://www.adobe.com/products/coldfusion/
II. DESCRIPTION
Remote exploitation of an input validation vulnerability in Adobe Systems Inc.'s Macromedia ColdFusion MX 7 may allow an attacker to view file contents on the server.
The vulnerability specifically exists in that URL encoded filenames will be decoded by the IIS process and then again by the ColdFusion process. By supplying a URL containing a double encoded null byte and an extension handled by ColdFusion, such as '.cfm', it is possible to view the contents of any file which is not interpreted by ColdFusion.
III. Although this vulnerability does not in itself allow execution of code on the server, it may allow an attacker to discover sensitive information such as passwords or to discover vulnerabilities in other scripts on the system or potentially bypass some security restrictions.
IV. DETECTION
iDefense has confirmed this vulnerability exists in Adobe Macromedia ColdFusion MX 7.0.2, with all available fixes, running on Microsoft IIS vulnerable.
V. WORKAROUND
iDefense is unaware of any effective workarounds for this vulnerability.
VI. VENDOR RESPONSE
Adobe has released a patch for this issue. For more information consult their advisory at the link below.
http://www.adobe.com/support/security/bulletins/apsb07-02.html
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-5858 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
11/08/2006 Initial vendor notification 11/09/2006 Initial vendor response 01/09/2007 Coordinated public disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Inge Henriksen.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright \xa9 2006 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German.
The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios.
This includes: * Reason for rating * Extended description * Extended solution * Exploit code or links to exploit code * Deep links
Read the full description: http://corporate.secunia.com/products/48/?r=l
Contact Secunia Sales for more information: http://corporate.secunia.com/how_to_buy/15/?r=l
TITLE: Adobe Download Manager AOM Buffer Overflow Vulnerability
SECUNIA ADVISORY ID: SA23233
VERIFY ADVISORY: http://secunia.com/advisories/23233/
CRITICAL: Highly critical
IMPACT: System access
WHERE:
From remote
SOFTWARE: Adobe Download Manager 1.x http://secunia.com/product/7045/ Adobe Download Manager 2.x http://secunia.com/product/12814/
DESCRIPTION: A vulnerability has been reported in Adobe Download Manager, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error when handling section names in the "dm.ini" file as created by Adobe Download Manager when processing AOM files. This can be exploited to cause a stack-based buffer overflow via a specially crafted AOM or "dm.ini" file.
Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious website.
SOLUTION: Update to version 2.2.
PROVIDED AND/OR DISCOVERED BY: Derek Soeder, eEye Digital Security.
The vendor also credits Zero Day Initiative.
ORIGINAL ADVISORY: Adobe: http://www.adobe.com/support/security/bulletins/apsb06-19.html
eEye Digital Security: http://research.eeye.com/html/advisories/published/AD20061205.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200612-0480",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "jrun",
"scope": "eq",
"trust": 2.4,
"vendor": "adobe",
"version": "4.0"
},
{
"model": "coldfusion",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "7.0.2"
},
{
"model": "coldfusion",
"scope": "gte",
"trust": 1.0,
"vendor": "adobe",
"version": "7.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "adobe",
"version": null
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "mx mx 7 to 7.0.2"
},
{
"model": "iis",
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "7.0"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "7.0.1"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "7.0.2"
},
{
"model": "coldfusion mx",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "7.02"
},
{
"model": "coldfusion mx",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "7.01"
},
{
"model": "coldfusion mx",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "7.00"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:adobe:coldfusion",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:adobe:jrun",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:microsoft:iis",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Inge Henriksen is credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "21978"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
}
],
"trust": 0.9
},
"cve": "CVE-2006-5858",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2006-5858",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2006-5858",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#448569",
"trust": 0.8,
"value": "4.62"
},
{
"author": "NVD",
"id": "CVE-2006-5858",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200612-697",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file. Adobe Download Manager contains a buffer overflow. This vulnerability may allow a remote, unauthenticated attacker to run arbitrary code with the privileges of the affected user or cause a denial-of-service condition. Adobe ColdFusion is prone to an information-disclosure vulnerability. \nSuccessfully exploiting this issue allows remote attackers to gain access to the contents of arbitrary files that are not interpreted by ColdFusion. This includes the source of scripting files not handled by ColdFusion, configuration files, log files, and other data files. Information harvested may aid attackers in further attacks. \nAdobe ColdFusion MX7, 7.0.1 and 7.0.2 are vulnerable. \n\n----------------------------------------------------------------------\n\nSecunia is proud to announce the availability of the Secunia Software\nInspector. \n\nThe Secunia Software Inspector is a free service that detects insecure\nversions of software that you may have installed in your system. When\ninsecure versions are detected, the Secunia Software Inspector also\nprovides thorough guidelines for updating the software to the latest\nsecure version from the vendor. \".cfm\". Other versions may also be affected. \n\nSOLUTION:\nApply hotfix (See vendor\u0027s advisory for details). Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability\n\niDefense Security Advisory 01.09.07\nhttp://labs.idefense.com/intelligence/vulnerabilities/\nJan 09, 2007\n\nI. BACKGROUND\n\nAdobe Macromedia ColdFusion is an application server and development\nframework for websites. More information is available at the following\nURL. \n\nhttp://www.adobe.com/products/coldfusion/\n\nII. DESCRIPTION\n\nRemote exploitation of an input validation vulnerability in Adobe Systems\nInc.\u0027s Macromedia ColdFusion MX 7 may allow an attacker to view file\ncontents on the server. \n\nThe vulnerability specifically exists in that URL encoded filenames will\nbe decoded by the IIS process and then again by the ColdFusion process. By\nsupplying a URL containing a double encoded null byte and an extension\nhandled by ColdFusion, such as \u0027.cfm\u0027, it is possible to view the contents\nof any file which is not interpreted by ColdFusion. \n\nIII. Although this\nvulnerability does not in itself allow execution of code on the server, it\nmay allow an attacker to discover sensitive information such as passwords\nor to discover vulnerabilities in other scripts on the system or\npotentially bypass some security restrictions. \n\nIV. DETECTION\n\niDefense has confirmed this vulnerability exists in Adobe Macromedia\nColdFusion MX 7.0.2, with all available fixes, running on Microsoft IIS\nvulnerable. \n\nV. WORKAROUND\n\niDefense is unaware of any effective workarounds for this vulnerability. \n\nVI. VENDOR RESPONSE\n\nAdobe has released a patch for this issue. For more information consult\ntheir advisory at the link below. \n\nhttp://www.adobe.com/support/security/bulletins/apsb07-02.html\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2006-5858 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n11/08/2006 Initial vendor notification\n11/09/2006 Initial vendor response\n01/09/2007 Coordinated public disclosure\n\nIX. CREDIT\n\nThis vulnerability was reported to iDefense by Inge Henriksen. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \\xa9 2006 iDefense, Inc. \n\nPermission is granted for the redistribution of this alert electronically. \nIt may not be edited in any way without the express written consent of\niDefense. If you wish to reprint the whole or any part of this alert in\nany other medium other than electronically, please e-mail\ncustomerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate at\nthe time of publishing based on currently available information. Use of\nthe information constitutes acceptance for use in an AS IS condition. \nThere are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct, indirect,\nor consequential loss or damage arising from use of, or reliance on, this\ninformation. \n\n----------------------------------------------------------------------\n\nTo improve our services to our customers, we have made a number of\nadditions to the Secunia Advisories and have started translating the\nadvisories to German. \n\nThe improvements will help our customers to get a better\nunderstanding of how we reached our conclusions, how it was rated,\nour thoughts on exploitation, attack vectors, and scenarios. \n\nThis includes:\n* Reason for rating\n* Extended description\n* Extended solution\n* Exploit code or links to exploit code\n* Deep links\n\nRead the full description:\nhttp://corporate.secunia.com/products/48/?r=l\n\nContact Secunia Sales for more information:\nhttp://corporate.secunia.com/how_to_buy/15/?r=l\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe Download Manager AOM Buffer Overflow Vulnerability\n\nSECUNIA ADVISORY ID:\nSA23233\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/23233/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nAdobe Download Manager 1.x\nhttp://secunia.com/product/7045/\nAdobe Download Manager 2.x\nhttp://secunia.com/product/12814/\n\nDESCRIPTION:\nA vulnerability has been reported in Adobe Download Manager, which\ncan be exploited by malicious people to compromise a user\u0027s system. \n\nThe vulnerability is caused due to a boundary error when handling\nsection names in the \"dm.ini\" file as created by Adobe Download\nManager when processing AOM files. This can be exploited to cause a\nstack-based buffer overflow via a specially crafted AOM or \"dm.ini\"\nfile. \n\nSuccessful exploitation allows execution of arbitrary code when a\nuser e.g. visits a malicious website. \n\nSOLUTION:\nUpdate to version 2.2. \n\nPROVIDED AND/OR DISCOVERED BY:\nDerek Soeder, eEye Digital Security. \n\nThe vendor also credits Zero Day Initiative. \n\nORIGINAL ADVISORY:\nAdobe:\nhttp://www.adobe.com/support/security/bulletins/apsb06-19.html\n\neEye Digital Security:\nhttp://research.eeye.com/html/advisories/published/AD20061205.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-5858"
},
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-5858",
"trust": 2.8
},
{
"db": "BID",
"id": "21978",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "23668",
"trust": 1.7
},
{
"db": "CERT/CC",
"id": "VU#448569",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1017490",
"trust": 1.6
},
{
"db": "VUPEN",
"id": "ADV-2007-0116",
"trust": 1.6
},
{
"db": "OSVDB",
"id": "32123",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "23233",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "53496",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "53585",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "52797",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"id": "VAR-200612-0480",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-11-23T21:57:24.851000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB07-02",
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.iis.net/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.0
},
{
"problemtype": "CWE-20",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"trust": 1.7,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/archive/1/457799/100/0/threaded"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/23668"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31411"
},
{
"trust": 1.6,
"url": "http://www.vupen.com/english/advisories/2007/0116"
},
{
"trust": 1.6,
"url": "http://securitytracker.com/id?1017490"
},
{
"trust": 1.6,
"url": "http://osvdb.org/32123"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/21978"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/23233/"
},
{
"trust": 0.9,
"url": "http://research.eeye.com/html/advisories/published/ad20061205.html"
},
{
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb06-19.html "
},
{
"trust": 0.8,
"url": "http://www.adobe.com/products/acrobat/acrrmanager.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-5858"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-5858"
},
{
"trust": 0.8,
"url": "http://www.kb.cert.org/vuls/id/448569"
},
{
"trust": 0.4,
"url": "http://www.adobe.com/products/coldfusion/"
},
{
"trust": 0.3,
"url": "/archive/1/456484"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/software_inspector/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/23668/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4984/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2006-5858"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/7045/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/12814/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/products/48/?r=l"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/15/?r=l"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb06-19.html"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#448569"
},
{
"db": "BID",
"id": "21978"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"db": "PACKETSTORM",
"id": "53496"
},
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "PACKETSTORM",
"id": "52797"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-12-07T00:00:00",
"db": "CERT/CC",
"id": "VU#448569"
},
{
"date": "2007-01-09T00:00:00",
"db": "BID",
"id": "21978"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"date": "2007-01-10T18:19:08",
"db": "PACKETSTORM",
"id": "53496"
},
{
"date": "2007-01-13T23:25:20",
"db": "PACKETSTORM",
"id": "53585"
},
{
"date": "2006-12-07T06:24:29",
"db": "PACKETSTORM",
"id": "52797"
},
{
"date": "2006-12-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"date": "2006-12-31T05:00:00",
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-12-07T00:00:00",
"db": "CERT/CC",
"id": "VU#448569"
},
{
"date": "2007-01-10T20:51:00",
"db": "BID",
"id": "21978"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-001531"
},
{
"date": "2020-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200612-697"
},
{
"date": "2024-11-21T00:20:50.727000",
"db": "NVD",
"id": "CVE-2006-5858"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "53585"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe Download Manager buffer overflow",
"sources": [
{
"db": "CERT/CC",
"id": "VU#448569"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200612-697"
}
],
"trust": 0.6
}
}
CVE-2009-1874 (GCVE-0-2009-1874)
Vulnerability from cvelistv5
Published
2009-08-18 22:00
Modified
2024-08-07 05:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.adobe.com/support/security/bulletins/apsb09-12.html | x_refsource_CONFIRM | |
| http://osvdb.org/57187 | vdb-entry, x_refsource_OSVDB | |
| http://www.dsecrg.com/pages/vul/show.php?id=151 | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/505804/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:27:54.783Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"name": "57187",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/57187"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=151"
},
{
"name": "20090817 [DSECRG-09-051] Adobe JRun 4 Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/505804/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-08-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"name": "57187",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/57187"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=151"
},
{
"name": "20090817 [DSECRG-09-051] Adobe JRun 4 Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/505804/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1874",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.adobe.com/support/security/bulletins/apsb09-12.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"name": "57187",
"refsource": "OSVDB",
"url": "http://osvdb.org/57187"
},
{
"name": "http://www.dsecrg.com/pages/vul/show.php?id=151",
"refsource": "MISC",
"url": "http://www.dsecrg.com/pages/vul/show.php?id=151"
},
{
"name": "20090817 [DSECRG-09-051] Adobe JRun 4 Multiple XSS",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/505804/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1874",
"datePublished": "2009-08-18T22:00:00",
"dateReserved": "2009-06-01T00:00:00",
"dateUpdated": "2024-08-07T05:27:54.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-5860 (GCVE-0-2006-5860)
Vulnerability from cvelistv5
Published
2007-02-14 02:00
Modified
2024-08-07 20:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/24093 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2007/0594 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/32475 | vdb-entry, x_refsource_XF | |
| http://www.securitytracker.com/id?1017647 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/22547 | vdb-entry, x_refsource_BID | |
| http://www.adobe.com/support/security/bulletins/apsb07-05.html | x_refsource_CONFIRM | |
| http://osvdb.org/32122 | vdb-entry, x_refsource_OSVDB | |
| http://www.securitytracker.com/id?1017646 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:04:55.630Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "24093",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24093"
},
{
"name": "ADV-2007-0594",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0594"
},
{
"name": "jrun-administrator-console-xss(32475)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32475"
},
{
"name": "1017647",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017647"
},
{
"name": "22547",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22547"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-05.html"
},
{
"name": "32122",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32122"
},
{
"name": "1017646",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017646"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-02-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "24093",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24093"
},
{
"name": "ADV-2007-0594",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0594"
},
{
"name": "jrun-administrator-console-xss(32475)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32475"
},
{
"name": "1017647",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017647"
},
{
"name": "22547",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22547"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-05.html"
},
{
"name": "32122",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32122"
},
{
"name": "1017646",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017646"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-5860",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "24093",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24093"
},
{
"name": "ADV-2007-0594",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0594"
},
{
"name": "jrun-administrator-console-xss(32475)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32475"
},
{
"name": "1017647",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017647"
},
{
"name": "22547",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22547"
},
{
"name": "http://www.adobe.com/support/security/bulletins/apsb07-05.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb07-05.html"
},
{
"name": "32122",
"refsource": "OSVDB",
"url": "http://osvdb.org/32122"
},
{
"name": "1017646",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017646"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-5860",
"datePublished": "2007-02-14T02:00:00",
"dateReserved": "2006-11-10T00:00:00",
"dateUpdated": "2024-08-07T20:04:55.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-1278 (GCVE-0-2007-1278)
Vulnerability from cvelistv5
Published
2007-03-16 20:00
Modified
2024-08-07 12:50
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id?1017752 | vdb-entry, x_refsource_SECTRACK | |
| http://osvdb.org/34039 | vdb-entry, x_refsource_OSVDB | |
| http://www.adobe.com/support/security/bulletins/apsb07-07.html | x_refsource_CONFIRM | |
| http://secunia.com/advisories/24488 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2007/0932 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/32994 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/22958 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:50:35.050Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017752",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017752"
},
{
"name": "34039",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/34039"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-07.html"
},
{
"name": "24488",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24488"
},
{
"name": "ADV-2007-0932",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0932"
},
{
"name": "coldfusion-jrun-iisconnector-dos(32994)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32994"
},
{
"name": "22958",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22958"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017752",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017752"
},
{
"name": "34039",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/34039"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-07.html"
},
{
"name": "24488",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24488"
},
{
"name": "ADV-2007-0932",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0932"
},
{
"name": "coldfusion-jrun-iisconnector-dos(32994)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32994"
},
{
"name": "22958",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22958"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1278",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017752",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017752"
},
{
"name": "34039",
"refsource": "OSVDB",
"url": "http://osvdb.org/34039"
},
{
"name": "http://www.adobe.com/support/security/bulletins/apsb07-07.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb07-07.html"
},
{
"name": "24488",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24488"
},
{
"name": "ADV-2007-0932",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0932"
},
{
"name": "coldfusion-jrun-iisconnector-dos(32994)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32994"
},
{
"name": "22958",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22958"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1278",
"datePublished": "2007-03-16T20:00:00",
"dateReserved": "2007-03-05T00:00:00",
"dateUpdated": "2024-08-07T12:50:35.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-1873 (GCVE-0-2009-1873)
Vulnerability from cvelistv5
Published
2009-08-18 22:00
Modified
2024-08-07 05:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/9443 | exploit, x_refsource_EXPLOIT-DB | |
| http://www.securityfocus.com/archive/1/505808/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.adobe.com/support/security/bulletins/apsb09-12.html | x_refsource_CONFIRM | |
| http://osvdb.org/57186 | vdb-entry, x_refsource_OSVDB | |
| http://www.dsecrg.com/pages/vul/show.php?id=152 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:27:54.702Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "9443",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/9443"
},
{
"name": "20090817 [DSECRG-09-052] Adobe JRun 4 Directory Traversal Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/505808/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"name": "57186",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/57186"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=152"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-08-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "9443",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/9443"
},
{
"name": "20090817 [DSECRG-09-052] Adobe JRun 4 Directory Traversal Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/505808/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"name": "57186",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/57186"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=152"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1873",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "9443",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/9443"
},
{
"name": "20090817 [DSECRG-09-052] Adobe JRun 4 Directory Traversal Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/505808/100/0/threaded"
},
{
"name": "http://www.adobe.com/support/security/bulletins/apsb09-12.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"name": "57186",
"refsource": "OSVDB",
"url": "http://osvdb.org/57186"
},
{
"name": "http://www.dsecrg.com/pages/vul/show.php?id=152",
"refsource": "MISC",
"url": "http://www.dsecrg.com/pages/vul/show.php?id=152"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1873",
"datePublished": "2009-08-18T22:00:00",
"dateReserved": "2009-06-01T00:00:00",
"dateUpdated": "2024-08-07T05:27:54.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-5858 (GCVE-0-2006-5858)
Vulnerability from cvelistv5
Published
2007-01-10 02:00
Modified
2024-08-07 20:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.adobe.com/support/security/bulletins/apsb07-02.html | x_refsource_CONFIRM | |
| http://www.securityfocus.com/archive/1/457799/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/23668 | third-party-advisory, x_refsource_SECUNIA | |
| http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466 | third-party-advisory, x_refsource_IDEFENSE | |
| http://securitytracker.com/id?1017490 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/21978 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/32123 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0116 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/31411 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:04:55.769Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"name": "20070121 Adobe ColdFusion Information Disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/457799/100/0/threaded"
},
{
"name": "23668",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23668"
},
{
"name": "20070109 Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability",
"tags": [
"third-party-advisory",
"x_refsource_IDEFENSE",
"x_transferred"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466"
},
{
"name": "1017490",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017490"
},
{
"name": "21978",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21978"
},
{
"name": "32123",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32123"
},
{
"name": "ADV-2007-0116",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0116"
},
{
"name": "coldfusion-urlparsing-info-disclosure(31411)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31411"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"name": "20070121 Adobe ColdFusion Information Disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/457799/100/0/threaded"
},
{
"name": "23668",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23668"
},
{
"name": "20070109 Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability",
"tags": [
"third-party-advisory",
"x_refsource_IDEFENSE"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466"
},
{
"name": "1017490",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017490"
},
{
"name": "21978",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21978"
},
{
"name": "32123",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32123"
},
{
"name": "ADV-2007-0116",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0116"
},
{
"name": "coldfusion-urlparsing-info-disclosure(31411)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31411"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-5858",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.adobe.com/support/security/bulletins/apsb07-02.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"name": "20070121 Adobe ColdFusion Information Disclosure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/457799/100/0/threaded"
},
{
"name": "23668",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23668"
},
{
"name": "20070109 Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability",
"refsource": "IDEFENSE",
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466"
},
{
"name": "1017490",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017490"
},
{
"name": "21978",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21978"
},
{
"name": "32123",
"refsource": "OSVDB",
"url": "http://osvdb.org/32123"
},
{
"name": "ADV-2007-0116",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0116"
},
{
"name": "coldfusion-urlparsing-info-disclosure(31411)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31411"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-5858",
"datePublished": "2007-01-10T02:00:00",
"dateReserved": "2006-11-10T00:00:00",
"dateUpdated": "2024-08-07T20:04:55.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2007-03-16 20:19
Modified
2025-04-09 00:30
Severity ?
Summary
Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | internet_information_server | 6.0 | |
| adobe | coldfusion | 6.1 | |
| adobe | coldfusion | 7.0 | |
| adobe | jrun | 4.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:internet_information_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F7C954A7-FF84-4DEB-8728-5B207F374ECC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:coldfusion:6.1:*:enterprise_server:*:*:*:*:*",
"matchCriteriaId": "8B70C03A-1B4B-46D9-99CB-45EFB2109F15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:7.0:*:enterprise_server:*:*:*:*:*",
"matchCriteriaId": "B9C93E8B-6AD0-473C-9161-C71E03BFDEC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:updater6:*:*:*:*:*:*",
"matchCriteriaId": "A2A614E7-95D2-4473-BBBB-7CE0D96D9562",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en el conector IIS en Adobe JRun 4.0 Updater 6, y ColdFusion MX 6.1 y 7.0 Enterprise, cuando se utiliza Microsoft IIS 6, permite a atacantes remotos provocar denegaci\u00f3n de servicio a trav\u00e9s de vectores no especificados, afectando a la respuesta de un archivo en la raiz web JRun."
}
],
"evaluatorComment": "Per: http://www.adobe.com/support/security/bulletins/apsb07-07.html\r\n\r\nCVE number: CVE-2007-1278\r\n\r\nPlatform: Windows only\r\nAffected software versions: ColdFusion MX 7.X\r\n\r\n * JRun 4.0 Updater 6\r\n * ColdFusion MX 7.0 Enterprise Edition, if installed as the \"Multi-Server\" option\r\n * ColdFusion MX 6.1 Enterprise, if installed with the \"J2EE\" option and deployed on JRun 4.0 Updater 6\r\n\r\nNOTE: ColdFusion MX 6.1 and 7.0 Standard editions are not affected.",
"evaluatorSolution": "This vulnerability has been addressed by the vendor with the following patch: http://www.adobe.com/support/security/bulletins/apsb07-07.html",
"id": "CVE-2007-1278",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-03-16T20:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/34039"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24488"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-07.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22958"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017752"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0932"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32994"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/34039"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24488"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-07.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22958"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017752"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0932"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32994"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-12-31 05:00
Modified
2025-04-09 00:30
Severity ?
Summary
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| adobe | coldfusion | * | |
| adobe | jrun | 4.0 | |
| microsoft | internet_information_services | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3B975D3B-17A7-416A-86AA-0D24989EC5EA",
"versionEndIncluding": "7.0.2",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92AEE969-DBA5-4240-850B-E34CEC231052",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:internet_information_services:-:*:*:*:*:*:*:*",
"matchCriteriaId": "866547A0-AC34-41F8-A6AA-E8D820237C0B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file."
},
{
"lang": "es",
"value": "Adobe ColdFusion MX 7 hasta 7.0.2, y JRun 4, cuando se ejecuta en Microsoft IIS, permite a atacantes remotos leer archivos de su elecci\u00f3n, listar directorios, o leer c\u00f3digo fuente mediante un byte nulo (NULL) con doble codificaci\u00f3n URL en un nombre de archivo ColdFusion, por ejemplo un archivo CFM."
}
],
"id": "CVE-2006-5858",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/32123"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23668"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017490"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/archive/1/457799/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/21978"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0116"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31411"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/32123"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23668"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017490"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-02.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/archive/1/457799/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/21978"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0116"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31411"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-08-18 22:30
Modified
2025-04-09 00:30
Severity ?
Summary
Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92AEE969-DBA5-4240-850B-E34CEC231052",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:updater7:*:*:*:*:*:*",
"matchCriteriaId": "3F67F854-FE93-480F-B84A-C0EF9706F582",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en logging/logviewer.jsp en la consola de administraci\u00f3n en Adobe JRun Application Server 4 Updater 7 permite a usuarios remotos autenticados leer ficheros de forma arbitraria a trav\u00e9s de .. (punto punto) en el par\u00e1metro \"logfile\"."
}
],
"id": "CVE-2009-1873",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-08-18T22:30:00.250",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/57186"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=152"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/505808/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/9443"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/57186"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=152"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/505808/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/9443"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-02-14 02:28
Modified
2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:coldfusion:6.1:*:enterprise_server:*:*:*:*:*",
"matchCriteriaId": "8B70C03A-1B4B-46D9-99CB-45EFB2109F15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:7.0:*:enterprise_multi-server:*:*:*:*:*",
"matchCriteriaId": "FEF92A65-AE47-4A8B-BCBF-E8839A88A1C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92AEE969-DBA5-4240-850B-E34CEC231052",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "A392C7BB-CDA6-4D1D-BBEE-389B3987858C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:sp1a:*:*:*:*:*:*",
"matchCriteriaId": "60F287F9-F041-4077-BC6C-0A7019FF68A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0_build_61650:*:*:*:*:*:*:*",
"matchCriteriaId": "75BFCEDD-6FDC-4600-AC61-D3E3CBA1B31F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la consola de administraci\u00f3n de Adobe JRun 4.0, como el usado en ColdFusion, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante vectores desconocidos."
}
],
"id": "CVE-2006-5860",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-02-14T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32122"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/24093"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-05.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/22547"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017646"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017647"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0594"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32475"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32122"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/24093"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb07-05.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/22547"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017646"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017647"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0594"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32475"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-08-18 22:30
Modified
2025-04-09 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:jrun:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92AEE969-DBA5-4240-850B-E34CEC231052",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos (XSS) en Management Console en Adobe JRun v4.0 permite a atacantes remotos inyectar script web o HTML a su elecci\u00f3n a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2009-1874",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-08-18T22:30:00.297",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/57187"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=151"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/505804/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/57187"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb09-12.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.dsecrg.com/pages/vul/show.php?id=151"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/505804/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}