Richard Brain

The authentication process in Adobe ColdFusion does not require knowledge of the cleartext password if the password hash is known. This makes it easier for attackers to obtain administrative privileges by leveraging read access to the configuration file.

A cross-site scripting (XSS) issue exists in the function menu API, allowing remote authenticated backend users to inject arbitrary web script or HTML.

The issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks.

The issue allows remote attackers to read arbitrary files due to directory traversal vulnerabilities in the administrator console. This is achieved via the `locale` parameter to various CFIDE/administrator/ endpoints, including "CFIDE/administrator/settings/mappings.cfm", "logging/settings.cfm", "datasources/index.cfm", "j2eepackaging/editarchive.cfm", and "enter.cfm". The vulnerability exists because of incorrect restriction of the directory path name with limited access.

A cross-site scripting (XSS) issue exists in the administration console, allowing remote attackers to inject arbitrary web script or HTML via the `modules` parameter. This affects products that use Apache Axis2, such as SAP Business Objects 12 and 3com IMC.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `servercert` parameter in the `proxy/smhui/getuiinfo` endpoint.

The issue allows remote attackers to obtain sensitive information via a direct request to certain PHP files, specifically "blog/blogpage.php" and "course/report/stats/report.php", when display errors is enabled. This reveals the installation path in an error message.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via an ftp URL in the `url` parameter to a Redirect action, particularly when accessed through certain browsers like Mozilla Firefox.

The issue allows remote attackers to obtain sensitive information via a direct request for "spyce/examples/automaton.spy", which reveals the path in an error message.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `url` parameter. This can be exploited by providing a malicious URL to the vulnerable application.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved through various parameters in different API endpoints, including: the `url` or `type` parameter to "docs/examples/redirect.spy"; the `x` parameter to "docs/examples/handlervalidate.spy"; the `name` parameter to "spyce/examples/request.spy"; the `Name` parameter to "spyce/examples/getpost.spy"; the `mytextarea`, `mypass`, or an empty parameter to "spyce/examples/formtag.spy"; the `newline` parameter to the default URI under "demos/chat/"; the `text1` parameter to "docs/examples/formintro.spy"; or the `mytext` or `mydate` parameter to "docs/examples/formtag.spy".

The issue allows remote attackers to obtain sensitive information. This is achieved via a direct request to "getpath.aspx", which reveals the installation path in an error message.

The issue allows remote attackers to bypass request filtering, which can lead to cross-site scripting (XSS) attacks or cause a denial of service. This can be achieved by exploiting the improper handling of comment enclosures, for example, via an xss:expression STYLE attribute in a closing XSS HTML tag.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `sid` parameter in the my.acctab.php3 file. This could potentially lead to unauthorized actions on the affected system.