Allaire: >> Coldfusion Server >> 4.5 Security Vulnerabilities
ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message.
CVSS Score
5.0
EPSS Score
0.011
Published
2002-06-18
Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary files, or (2) overwrite ColdFusion Server templates.
CVSS Score
6.4
EPSS Score
0.018
Published
2001-07-11
ColdFusion Administrator for ColdFusion 4.5.1 and earlier allows remote attackers to cause a denial of service via a long login password.
CVSS Score
5.0
EPSS Score
0.09
Published
2000-06-07
ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files.
CVSS Score
5.0
EPSS Score
0.006
Published
2000-03-01