Vulnerabilidades do Adobe Coldfusion

CVE-2023-29300 Crítica · 9.8 KEV Urgente · 87 Exploit público Ransomware CWE-502 12/07/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-26360 Alta · 8.6 KEV Urgente · 79 Exploit público CWE-284 23/03/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CVE-2023-26359 Crítica · 9.8 KEV Alta · 63 CWE-502 23/03/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CVE-2018-15961 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-434 25/09/2018

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

CVE-2018-4939 Crítica · 9.8 KEV Alta · 63 CWE-502 19/05/2018

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

CVE-2017-3066 Crítica · 9.8 KEV Urgente · 87 Exploit público CWE-502 27/04/2017

Adobe ColdFusion Deserialization Vulnerability

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

CVE-2013-0632 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-276 16/01/2013

Adobe ColdFusion Authentication Bypass Vulnerability

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

CVE-2013-0629 Alta · 7.5 KEV Alta · 67 Exploit público 08/01/2013

Adobe ColdFusion Directory Traversal Vulnerability

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.

CVE-2013-0631 Alta · 7.5 KEV Alta · 59 08/01/2013

Adobe ColdFusion Information Disclosure Vulnerability

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

CVE-2013-0625 Crítica · 9.8 KEV Urgente · 71 Exploit público CWE-287 08/01/2013

Adobe ColdFusion Authentication Bypass Vulnerability

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

CVE-2010-2861 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 11/08/2010

Adobe ColdFusion Directory Traversal Vulnerability

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

CVE-2009-3960 Média · 6.5 KEV Urgente · 83 Exploit público Ransomware 15/02/2010

Adobe BlazeDS Information Disclosure Vulnerability

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.