CVE-1999-0477

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/115Patch, Vendor Advisory
http://www.securityfocus.com/bid/115Patch, Vendor Advisory

Timeline

Published: Dec 25, 1999
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 1999

CVE-1999-04795.0Denial of service Netscape Enterprise Server with VirtualVault on HP-UX VVOS systems.CVE-1999-04802.1Local attackers can conduct a denial of service in Midnight Commander 4.x with a symlink attack.CVE-1999-04815.0Denial of service in "poll" in OpenBSD.CVE-1999-04825.0OpenBSD kernel crash through TSS handling, as caused by the crashme program.CVE-1999-04832.1OpenBSD crash using nlink value in FFS and EXT2FS filesystems.CVE-1999-04842.1Buffer overflow in OpenBSD ping.CVE-1999-04852.6Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.CVE-1999-04872.6The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files.CVE-1999-04887.5Internet Explorer 4.0 and 5.0 allows a remote attacker to execute security scripts in a different security context using malicious URLs, a v CVE-1999-048910.0MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to paste a file name into the file upload intrinsic control, a variant of "untr CVE-1999-04907.5MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to learn information about a local user's files via an IMG SRC tag.CVE-1999-04914.6The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to e