Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

The VMware vCenter Server installed on the remote host is affected by the following vulnerabilities :

  - An XML external entity (XXE) injection flaw exists in     Flex BlazeDS in the file flex-messaging-core.jar due to     an incorrectly configured XML parser accepting XML     external entities from untrusted sources. A remote     attacker can exploit this, via a specially crafted AMF     message containing an XML external entity declaration in     conjunction with an entity reference, to read arbitrary     files and thus gain access to potentially sensitive     information. (CVE-2015-3269)

  - A server-side request forgery (SSRF) vulnerability exists     in Flex BlazeDS. A remote attacker can exploit this,     via a crafted XML document, to direct HTTP traffic to     intranet servers, thus bypassing access restrictions and     allowing further host-based attacks to be conducted.
    (CVE-2015-5255)

The version of Adobe ColdFusion running on the remote Windows host is affected by multiple vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist due to a failure to validate input before     returning it to the user. A remote attacker can exploit     these to inject arbitrary script or HTML into the user's     browser session. (CVE-2015-8052, CVE-2015-8053)

  - A flaw exists in BlazeDS related to request handling     between a user and a server. A remote attacker can     exploit this, via a crafted XML document, to send HTTP     traffic to intranet servers, thus allowing the attacker     to carry out a server-side request forgery attacks.
    (CVE-2015-5255)

The VMware Horizon View installed on the remote Windows host is version 5.x prior to 5.3.4 or version 6.x prior to 6.1. It is, therefore, affected by the following vulnerabilities :

  - A man-in-the-middle (MitM) information disclosure     vulnerability, known as POODLE, exists due to the way     SSL 3.0 handles padding bytes when decrypting messages     encrypted using block ciphers in cipher block chaining     (CBC) mode. A MitM attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections.
    (CVE-2014-3566)

  - An XML external entity (XXE) injection vulnerability     exists in the included Flex BlazeDS component due to an     incorrect configuration of the XML parser that allows     external XML entities to be accepted from untrusted     sources. An unauthenticated, remote attacker can exploit     this vulnerability, via a via a crafted AMF message, to     gain access to sensitive information. (CVE-2015-3269)

  - A flaw exists in the bundled Adobe ColdFusion and     LiveCycle Data Services components related to request     handling between a user and the server. A remote     attacker can exploit this, via a specially crafted     request, to bypass access restrictions (e.g. host or     network ACLs), conduct port scanning of internal     networks, enumerate internal hosts, or possibly invoke     additional protocols (e.g. Gopher, TFTP).
    (CVE-2015-5255)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

ID	Name	Product	Family	Type	Severity
87592	VMware vCenter Multiple Vulnerabilities (VMSA-2015-0008)	Nessus	Misc.	Remote	medium
86948	Adobe ColdFusion Multiple Vulnerabilities (APSB15-29) (credentialed check)	Nessus	Windows	Local	medium
82741	VMware Horizon View Multiple Vulnerabilities (VMSA-2015-0003) (VMSA-2015-0008) (POODLE)	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2015-5255

medium

Tenable Plugins

medium

medium

critical