{"id":"CVE-2015-8052","aliases":["EUVD-2015-7945","GHSA-q5fm-hcx4-6q63","MGASA-2015-0468"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before...","description":"Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03119,"percentile":0.87918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2015-11-18T21:00:00Z","modified":"2026-06-17T00:33:56Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.554-1.mga5.nonfree"}]}],"bundled":78}],"products":[{"vendor":"adobe","product":"coldfusion"}],"references":[{"url":"http://www.securityfocus.com/bid/77625","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1034211","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8052"},{"url":"https://github.com/advisories/GHSA-q5fm-hcx4-6q63"},{"url":"https://advisories.mageia.org/MGASA-2015-0468.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17313","tags":["report"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-32.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-8052","description":"Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.","status":"published","published":"2015-11-18T21:00:00Z","modified":"2024-08-06T08:06:31.791Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-7945","description":"Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.","status":"published","published":"2015-11-18T21:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T01:57:28.296316Z"}],"ghsa":[{"id":"GHSA-q5fm-hcx4-6q63","title":"Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before...","description":"Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.","status":"published","published":"2022-05-13T01:17:40Z","modified":"2023-02-01T05:05:17Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:50:13.694184Z"}],"nvd":[{"id":"CVE-2015-8052","description":"Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.","status":"published","published":"2015-11-18T21:59:02.647Z","modified":"2026-06-17T00:33:56.727Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"MGASA-2015-0468","title":"Updated flash-player-plugin package fixes security vulnerabilities","description":"Adobe Flash Player 11.2.202.554 contains fixes to critical security vulnerabilities\nfound in earlier versions that could potentially allow an attacker to take control\nof the affected system.\n\nThis update resolves heap buffer overflow vulnerabilities that could lead to code\nexecution (CVE-2015-8438, CVE-2015-8446).\n\nThis update resolves memory corruption vulnerabilities that could lead to code\nexecution (CVE-2015-8444, CVE-2015-8443, CVE-2015-8417, CVE-2015-8416, CVE-2015-8451,\nCVE-2015-8047, CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060,\nCVE-2015-8419, CVE-2015-8408).\n\nThis update resolves security bypass vulnerabilities (CVE-2015-8453, CVE-2015-8440,\nCVE-2015-8409).\n\nThis update resolves a stack overflow vulnerability that could lead to code\nexecution (CVE-2015-8407).\n\nThis update resolves a type confusion vulnerability that could lead to code\nexecution (CVE-2015-8439).\n\nThis update resolves an integer overflow vulnerability that could lead to code\nexecution (CVE-2015-8445).\n\nThis update resolves a buffer overflow vulnerability that could lead to code\nexecution (CVE-2015-8415)\n\nThis update resolves use-after-free vulnerabilities that could lead to code\nexecution (CVE-2015-8050, CVE-2015-8049, CVE-2015-8437, CVE-2015-8450, CVE-2015-8449,\nCVE-2015-8448, CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413,\nCVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424, CVE-2015-8422,\nCVE-2015-8420, CVE-2015-8421, CVE-2015-8423, CVE-2015-8425, CVE-2015-8433,\nCVE-2015-8432, CVE-2015-8431, CVE-2015-8426, CVE-2015-8430, CVE-2015-8427,\nCVE-2015-8428, CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414,\nCVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055, CVE-2015-8057,\nCVE-2015-8056, CVE-2015-8061, CVE-2015-8067, CVE-2015-8066, CVE-2015-8062,\nCVE-2015-8068, CVE-2015-8064, CVE-2015-8065, CVE-2015-8063, CVE-2015-8405,\nCVE-2015-8404, CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401,\nCVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441, CVE-2015-8442,\nCVE-2015-8447).\n","status":"published","published":"2015-12-09T10:53:03Z","modified":"2026-04-16T06:26:13.184220521Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}