CVE-2018-15958

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2018-15961

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2018-15965

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2018-4942

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure...

Adobe ColdFusion APSB17-30 Remote Command Execution Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. A security vulnerability exists in Adobe ColdFusion 2016 release Update 4 and earlier and ColdFusion 11 Upda...

The vulnerability of the ColdFusion interpreter, which allows a hacker to modify the structure of a web page

The vulnerability of the ColdFusion interpreter exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to remotely alter the structure of the web page...

The vulnerability of the ColdFusion interpreter allows attackers to read arbitrary files or send TCP requests to servers in the internal network.

The vulnerability of the Office Open XML OOXML file format in ColdFusion is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows an attacker to remotely read arbitrary files or send TCP requests to internal server networks using a specially...

The vulnerability of the ColdFusion interpreter, allowing attackers to execute arbitrary commands

The vulnerability of the ColdFusion interpreter exists due to the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands using a specially crafted serialized Java object related to the Apache Commons...

The vulnerability of the ColdFusion interpreter allows attackers to replace the server.

The vulnerability of the ColdFusion interpreter exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to replace the server using a specially crafted certificate...

The vulnerability of the ColdFusion interpreter allows attackers to redirect HTTP traffic to internal servers.

The vulnerability of the Adobe BlazeDS interpreter, ColdFusion, exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to redirect HTTP traffic to internal servers using a specially crafted XML document related to a forged SSRF request...

British Man Indicted for Hacking U.S. Governement

The United States District Court in New Jersey is accusing British citizen Lauri Love, and others not named, of conspiring to and illegally accessing various government and military networks. The purpose of these attacks, prosecutors said, was to steal vast stores of personally identifiable and...

VulnCheck KEV: CVE-2013-3336

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors...

CVE-2013-0625

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013...

Lomtec ActiveWeb Professional 3.0 CMS Allows Arbitrary File Upload and Execution as SYSTEM in ColdFusion (2010-WEB-002) (CERT VU#528212)

------------------------------------------------------------------------------------- www.ExploitDevelopment.com 2010-WEB-002 CERT VU870532 Security Focus BID 45985 ------------------------------------------------------------------------------------- TITLE: Lomtec ActiveWeb Professional 3.0 CMS...

CVE-2009-3960

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are...

Macromedia ColdFusion MX 6.1 - Template Handling Privilege Escalation

source: https://www.securityfocus.com/bid/11316/info Reportedly Macromedia ColdFusion MX is affected by privilege escalation vulnerability when handling templates. This issue is due to an access validation error that allows a user to perform actions with administrator privileges. An attacker may...

ColdFusion SQL Error Pages XSS

---------- NOTE ABOUT COLDFUSION XSS ATTACKS Vendor: Macromedia Versions: MX 6.0 tested , older ? PROBLEM: When you access to an error page of sql you can insert xss code to be shown in the error uotput of the sql backend. example: http://target/article.cfm?id=1'scriptalertdocument.cookie;/script...

ColdFusion cross-site scripting security vulnerability of an error page

The outline of vulnerability Macromedia's ColdFusion can display the various information about an error at the time of error occurred. There is information transmitted from a client machine like "Referer". ColdFusion displays the information as it is. An attacker can execute a script on victim's...

CVE-2002-0576

ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message...

CVE-2002-1309

Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary via an HTTP GET request with a long .cfm file name...