The vulnerability of the ColdFusion software platform arises from the overflow of the stack-based buffer, allowing an attacker to execute arbitrary code.

The vulnerability of the ColdFusion software platform arises from an overflow in the stack-based buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the ColdFusion software platform arises from an incorrect limitation on the path to the restricted access directory. This allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information...

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution...

PT-2023-1943

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2018 Update 15 and earlier and 2021 Update 5 and earlier Description The issue is related to a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the curren...

CVE-2023-26359

Adobe ColdFusion versions 2018 Update 15 and earlier and 2021 Update 5 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Rece...

PT-2023-1713

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2018 Update 15 and earlier and 2021 Update 5 and earlier Description The vulnerability in Adobe ColdFusion is related to improper access control and deserialization of untrusted data, which could result in arbitrary...

VulnCheck KEV: CVE-2023-26360

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution...

APSB23-25 : Security update available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2021 and 2018. These updates resolve critical and important vulnerabilities that could lead to arbitrary code execution and memory leak...

Adobe ColdFusion Unauthenticated Remote Code Execution

This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to gain remote code execution. Module Options msf use...

The vulnerability of the ColdFusion software platform arises from insufficient validation of input data, allowing attackers to disclose protected information.

The vulnerability of the ColdFusion software platform exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information that is protected by the system...

The vulnerability of the ColdFusion software platform, related to writing outside the buffer boundaries, allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to writing code outside the buffer boundaries. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted network package...

The vulnerability of the ColdFusion software platform, related to the use of pre-installed credentials, allows a hacker to trigger a service failure.

The vulnerability of the ColdFusion software platform is related to the use of pre-installed user credentials. Exploiting this vulnerability could allow an attacker to trigger a service failure...

The vulnerability of the ColdFusion software platform arises from incorrect restrictions on the path to the restricted access catalog. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Lucee Authenticated Scheduled Job Code Execution Exploit

This Metasploit module can be used to execute a payload on Lucee servers that have an exposed administrative web interface. It's possible for an administrator to create a scheduled job that queries a remote ColdFusion file, which is then downloaded and executed when accessed. The payload is...

Lucee Authenticated Scheduled Job Code Execution

class MetasploitModule 'Lucee Authenticated Scheduled Job Code Execution', 'Description' = %q This module can be used to execute a payload on Lucee servers that have an exposed administrative web interface. It's possible for an administrator to create a scheduled job that queries a remote...

SUSE CVE-2002-1700

Cross-site scripting vulnerability XSS in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message...

SUSE CVE-2015-8052

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053...

SUSE CVE-2015-8053

Cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052...

Lucee Authenticated Scheduled Job Code Execution

This module can be used to execute a payload on Lucee servers that have an exposed administrative web interface. It's possible for an administrator to create a scheduled job that queries a remote ColdFusion file, which is then downloaded and executed when accessed. The payload is uploaded as a cf...

The vulnerability of the ColdFusion software platform arises from incorrect path name restrictions for restricted access directories, allowing attackers to read arbitrary files.

The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path to the restricted directory. Exploitation of these vulnerabilities could allow a malicious actor to read arbitrary files through parameters such as CFIDE/administrator/settings/mappings.cfm,...