Adobe Coldfusion vulnerabilities

CVE-2023-29300 Critical · 9.8 KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 12, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-26360 High · 8.6 KEV Urgent · 79 Public exploit CWE-284 Mar 23, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CVE-2023-26359 Critical · 9.8 KEV High · 63 CWE-502 Mar 23, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CVE-2018-15961 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-434 Sep 25, 2018

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

CVE-2018-4939 Critical · 9.8 KEV High · 63 CWE-502 May 19, 2018

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

CVE-2017-3066 Critical · 9.8 KEV Urgent · 87 Public exploit CWE-502 Apr 27, 2017

Adobe ColdFusion Deserialization Vulnerability

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

CVE-2013-0632 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-276 Jan 16, 2013

Adobe ColdFusion Authentication Bypass Vulnerability

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

CVE-2013-0629 High · 7.5 KEV High · 67 Public exploit Jan 8, 2013

Adobe ColdFusion Directory Traversal Vulnerability

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.

CVE-2013-0631 High · 7.5 KEV High · 59 Jan 8, 2013

Adobe ColdFusion Information Disclosure Vulnerability

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

CVE-2013-0625 Critical · 9.8 KEV Urgent · 71 Public exploit CWE-287 Jan 8, 2013

Adobe ColdFusion Authentication Bypass Vulnerability

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

CVE-2010-2861 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Aug 11, 2010

Adobe ColdFusion Directory Traversal Vulnerability

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

CVE-2009-3960 Medium · 6.5 KEV Urgent · 83 Public exploit Ransomware Feb 15, 2010

Adobe BlazeDS Information Disclosure Vulnerability

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.