Metasploit Wrap-Up 05/10/2024

Password Spraying support Multiple bruteforce/login scanner modules have been updated to support a PASSWORDSPRAY module option. This work was completed in pull request 19079 from nrathaus as well as an additional update from our developers . When the password spraying option is set, the order of...

VulnCheck KEV: CVE-2023-26347

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

Adobe ColdFusion Arbitrary File Read

Adobe ColdFusion prior to versions 2021 Update 13 or 2023 Update 7, suffer from an Improper Access Control vulnerability that could lead to arbitrary file system read. By leveraging this vulnerability, a remote unauthenticated attacker can access to sensitive files and perform arbitrary file syst...

VulnCheck KEV: CVE-2024-20767

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel...

Adobe ColdFusion < 2021 Update 12 / < 2023 Update 6 Cross-Site Scripting

Adobe ColdFusion prior to versions 2021 Update 12 or 2023 Update 6, suffer from a Cross-Site Scripting vulnerability through a specially forged URL. No source data...

Exploit for Improper Access Control in Adobe Coldfusion

CVE-2024-20767 Exploit for Adobe ColdFusion 🛠️ This repositor...

Exploit for Improper Access Control in Adobe Coldfusion

Proof of Concept script for CVE-2024-20767 Overview get-...

Exploit for Improper Access Control in Adobe Coldfusion

CVE-2024-20767 CVE-2024-20767https://nvd.nist.gov/vuln...

Adobe ColdFusion Arbitrary File Read Vulnerability at Audobee Software (Shanghai) Co.

Adobe ColdFusion is a dynamic web server. Adobe ColdFusion by Audobee Software Shanghai Co., Ltd. has an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

Adobe ColdFusion < 2021 Update 12 / < 2023 Update 6 Remote Code Execution

Adobe ColdFusion prior to versions 2021 Update 12 or 2023 Update 6, suffer from an Insecure Deserialization vulnerability through the argumentCollection parameter on /CFIDE/wizards/common/utils.cfc endpoint. By leveraging this vulnerability, a remote unauthenticated attacker could achieve a remot...

Adobe ColdFusion Access Control Error Vulnerability (CNVD-2024-21156)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from an Access Control Error vulnerability, which arises from the presence of...

The vulnerability of the ColdFusion software platform, related to deficiencies in access control, allows attackers to gain access to confidential information.

The vulnerability of the ColdFusion software platform is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential information—specifically, to read and write files...

CVE-2024-20767

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interactio...

CVE-2024-20767

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interactio...

CVE-2024-20767 ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interactio...

CVE-2024-20767 ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interactio...

CVE-2024-20767

CVE-2024-20767 affects Adobe ColdFusion 2023 (Update 6 and earlier) and 2021 (Update 12 and earlier) due to an Improper Access Control weakness that allows an attacker to perform an arbitrary file system read when the admin panel is internet-exposed. Multiple sources confirm public exploitation a...

CVE-2024-20767

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interactio...

Adobe ColdFusion 访问控制错误漏洞

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from an Access Control Error vulnerability, which arises from the presence of...

Vulnerability fixed in Adobe ColdFusion

Adobe has fixed a vulnerability in ColdFusion. A malicious party can exploit the vulnerability to bypass a security measure to bypass the vulnerability and thus gain access to sensitive data in the affected Adobe ColdFusion application. Adobe has released updates to fix the vulnerability in...