Vendor CVEs
Macromedia
All CVEs
116 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2001-1514 | 0.00 | — | 0.01 | Dec 31, 2001 | ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to (1) child processes created with and (2) child processes that call the CreateProcess function and are executed… | |||
| CVE-2001-0926 | 0.00 | — | 0.02 | Nov 28, 2001 | SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page, in which the request's body has an #include statement. | |||
| CVE-2001-0535 | 0.00 | — | 0.02 | Oct 30, 2001 | Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the "HTTP Host" (CGI.Host) variable in (1) the "Web… | |||
| CVE-2001-1427 | 0.00 | — | 0.02 | Jul 11, 2001 | Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors. | |||
| CVE-2001-1084 | 0.00 | — | 0.03 | Jul 2, 2001 | Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrun, or .thtml file that does not exist, which causes the Javascript to be inserted into an error message. | |||
| CVE-2001-0179 | 0.00 | — | 0.01 | May 3, 2001 | Allaire JRun 3.0 allows remote attackers to list contents of the WEB-INF directory, and the web.xml file in the WEB-INF directory, via a malformed URL that contains a "." | |||
| CVE-2001-0166 | 0.00 | — | 0.02 | Mar 26, 2001 | Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file. | |||
| CVE-2000-1049 | 0.00 | — | 0.02 | Dec 11, 2000 | Allaire JRun 3.0 http servlet server allows remote attackers to cause a denial of service via a URL that contains a long string of "." characters. | |||
| CVE-2000-1051 | 0.00 | — | 0.02 | Dec 11, 2000 | Directory traversal vulnerability in Allaire JRun 2.3 server allows remote attackers to read arbitrary files via the SSIFilter servlet. | |||
| CVE-2000-1052 | 0.00 | — | 0.01 | Dec 11, 2000 | Allaire JRun 2.3 server allows remote attackers to obtain source code for executable content by directly calling the SSIFilter servlet. | |||
| CVE-2000-0540 | 0.00 | — | 0.03 | Jun 22, 2000 | JSP sample files in Allaire JRun 2.3.x allow remote attackers to access arbitrary files (e.g. via viewsource.jsp) or obtain configuration information. | |||
| CVE-2000-0539 | 0.00 | — | 0.02 | Jun 22, 2000 | Servlet examples in Allaire JRun 2.3.x allow remote attackers to obtain sensitive information, e.g. listing HttpSession ID's via the SessionServlet servlet. | |||
| CVE-1999-1454 | 0.00 | — | 0.00 | Oct 4, 1999 | Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass the password prompt by pressing the ESC (Escape) key. | |||
| CVE-1999-1526 | 0.00 | — | 0.01 | Mar 11, 1999 | Auto-update feature of Macromedia Shockwave 7 transmits a user's password and hard disk information back to Macromedia. | |||
| CVE-1999-1271 | 0.00 | — | 0.00 | Jun 11, 1998 | Macromedia Dreamweaver uses weak encryption to store FTP passwords, which could allow local users to easily decrypt the passwords of other users. | |||
| CVE-1999-1525 | 0.00 | — | 0.01 | Mar 14, 1997 | Macromedia Shockwave before 6.0 allows a malicious webmaster to read a user's mail box and possibly access internal web servers via the GetNextText command on a Shockwave movie. |
- CVE-2001-1514Dec 31, 2001risk 0.00cvss —epss 0.01
ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to (1) child processes created with and (2) child processes that call the CreateProcess function and are executed…
- CVE-2001-0926Nov 28, 2001risk 0.00cvss —epss 0.02
SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page, in which the request's body has an #include statement.
- CVE-2001-0535Oct 30, 2001risk 0.00cvss —epss 0.02
Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the "HTTP Host" (CGI.Host) variable in (1) the "Web…
- CVE-2001-1427Jul 11, 2001risk 0.00cvss —epss 0.02
Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors.
- CVE-2001-1084Jul 2, 2001risk 0.00cvss —epss 0.03
Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrun, or .thtml file that does not exist, which causes the Javascript to be inserted into an error message.
- CVE-2001-0179May 3, 2001risk 0.00cvss —epss 0.01
Allaire JRun 3.0 allows remote attackers to list contents of the WEB-INF directory, and the web.xml file in the WEB-INF directory, via a malformed URL that contains a "."
- CVE-2001-0166Mar 26, 2001risk 0.00cvss —epss 0.02
Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file.
- CVE-2000-1049Dec 11, 2000risk 0.00cvss —epss 0.02
Allaire JRun 3.0 http servlet server allows remote attackers to cause a denial of service via a URL that contains a long string of "." characters.
- CVE-2000-1051Dec 11, 2000risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Allaire JRun 2.3 server allows remote attackers to read arbitrary files via the SSIFilter servlet.
- CVE-2000-1052Dec 11, 2000risk 0.00cvss —epss 0.01
Allaire JRun 2.3 server allows remote attackers to obtain source code for executable content by directly calling the SSIFilter servlet.
- CVE-2000-0540Jun 22, 2000risk 0.00cvss —epss 0.03
JSP sample files in Allaire JRun 2.3.x allow remote attackers to access arbitrary files (e.g. via viewsource.jsp) or obtain configuration information.
- CVE-2000-0539Jun 22, 2000risk 0.00cvss —epss 0.02
Servlet examples in Allaire JRun 2.3.x allow remote attackers to obtain sensitive information, e.g. listing HttpSession ID's via the SessionServlet servlet.
- CVE-1999-1454Oct 4, 1999risk 0.00cvss —epss 0.00
Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass the password prompt by pressing the ESC (Escape) key.
- CVE-1999-1526Mar 11, 1999risk 0.00cvss —epss 0.01
Auto-update feature of Macromedia Shockwave 7 transmits a user's password and hard disk information back to Macromedia.
- CVE-1999-1271Jun 11, 1998risk 0.00cvss —epss 0.00
Macromedia Dreamweaver uses weak encryption to store FTP passwords, which could allow local users to easily decrypt the passwords of other users.
- CVE-1999-1525Mar 14, 1997risk 0.00cvss —epss 0.01
Macromedia Shockwave before 6.0 allows a malicious webmaster to read a user's mail box and possibly access internal web servers via the GetNextText command on a Shockwave movie.
Page 3 of 3