Two Actively Exploited Security Flaws in Adobe and Oracle Products Flagged by CISA

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added two security flaws impacting Adobe ColdFusion and Oracle Agile Product Lifecycle Management PLM to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerabilities in question ar...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2017-3066link is external Adobe ColdFusion Deserialization Vulnerability CVE-2024-20953link is external Oracle Agile Product Lifecycle Management PLM Deserializatio...

Adobe ColdFusion Deserialization Vulnerability

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution...

CVE-2022-42340

Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction...

CVE-2022-42341

Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction...

CVE-2020-10145

The Adobe ColdFusion installer fails to set a secure access-control list ACL on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability...

Adobe ColdFusion < 2021.x < 2021u18 / 2023.x < 2023u12 Path Traversal (APSB24-107)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2021.x update 18 or 2023.x update 12. It is, therefore, affected by a vulnerability as referenced in the APSB24-107 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerabili...

Adobe ColdFusion path traversal vulnerability (CNVD-2025-0256230)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from a path traversal vulnerability, which arises when the program fails to...

The vulnerability of the ColdFusion software platform arises from incorrect restrictions on path names to restricted directories. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on path names in the restricted access catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Vulnerability fixed in Adobe ColdFusion

Adobe has fixed a vulnerability in ColdFusion versions 2023.11, 2021.17 and earlier. The vulnerability is in the way ColdFusion handles path traversal. This security issue can lead to unauthorized access to sensitive files and folders located outside the application's designated restricted...

CVE-2024-53961

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outsid...

CVE-2024-53961

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outsid...

CVE-2024-53961 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outsid...

CVE-2024-53961 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outsid...

CVE-2024-53961

CVE-2024-53961 affects Adobe ColdFusion 2023.11, 2021.17 and earlier, due to an improper limitation of a pathname to a restricted directory (path traversal) that can lead to arbitrary file-system reads. Impact per sources: potential disclosure of sensitive files or data outside the intended direc...

Adobe ColdFusion 路径遍历漏洞

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from a path traversal vulnerability, which arises when the program fails to...

CVE-2024-53961: Improper Limitation of a Pathname to a Restricted Directory

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outsid...

APSB24-107 : Security update available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2023 and 2021. These updates resolve a critical vulnerability that could lead to arbitrary file system read...

CISA and FBI Raise Alerts on Exploited Flaws and Expanding HiatusRAT Campaign

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added two security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of flaws is below - CVE-2024-20767 CVSS score: 7.4 - Adobe ColdFusion contains an...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-20767link is external Adobe ColdFusion Improper Access Control Vulnerability CVE-2024-35250link is external Microsoft Windows Kernel-Mode Driver Untrusted...