Adobe ColdFusion 2016.x < 2016u12 / 2018.x < 2018u5 Multiple Vulnerabilities (APSB19-47)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2016.x update 12 or 2018.x update 5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB19-47 advisory: - An unspecified command injection vulnerability via a vulnerable component could...

Adobe ColdFusion Multiple Vulnerabilities (APSB19-47)

Adobe ColdFusion is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:coldfusion"; if...

Adobe Releases Security Updates for ColdFusion

Adobe has released security updates to address vulnerabilities in ColdFusion. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review Adobe Security...

Command Execution Vulnerability in ColdFusion

Adobe ColdFusion is a commercial rapid development platform. It can be used as a development platform, as a Flash remote service or as a backend server for Adobe Flex applications. A command execution vulnerability exists in ColdFusion. An attacker could exploit this vulnerability to gain...

Adobe Unscheduled Update Fixes Critical ColdFusion Flaws

Adobe has issued an unscheduled security update that fixes two critical flaws in its ColdFusion product. The critical vulnerabilities could enable an attacker to either execute arbitrary code or bypass access control on impacted systems. Overall, Adobe released three patches – one for an...

PT-2019-3372

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2018 update 4 and earlier ColdFusion versions 2016 update 11 and earlier Description The issue is related to path traversal errors in the ColdFusion platform, allowing a remote attacker to write arbitrary files to the...

PT-2019-5998

Name of the Vulnerable Software and Affected Versions ColdFusion 2018 versions update 4 and earlier ColdFusion 2016 versions update 11 and earlier Description The issue is related to a security bypass that could lead to information disclosure in the context of the current user. Successful...

PT-2019-3371

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2018 update 4 and earlier ColdFusion versions 2016 update 11 and earlier Description The issue is related to the possibility of injecting external commands through a vulnerable module of the ColdFusion platform. This could...

APSB19-47 Security updates available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2018 and 2016. These updates resolve two critical and one important vulnerability that could lead to arbitrary code execution...

Symantec Advanced Secure Gateway (ASG) ProxySG - Unrestricted File Upload

Symantec Advanced Secure Gateway ASG ProxySG - Unrestricted File Upload ===========Security Intelligence============ Vendor Homepage: adobe.com Version: 2018 Tested on: Adobe ColdFusion 2018 Exploit Author: Pankaj Kumar Thakur Nepal ==========Table of Contents============== Overview Detailed...

Symantec Advanced Secure Gateway (ASG) / ProxySG - Unrestricted File Upload Vulnerability

Exploit for multiple platform in category web applications ===========Security Intelligence============ Vendor Homepage: adobe.com Version: 2018 Tested on: Adobe ColdFusion 2018 Exploit Author: Pankaj Kumar Thakur Nepal ==========Table of Contents============== Overview Detailed description Thank...

Symantec Advanced Secure Gateway (ASG) / ProxySG - Unrestricted File Upload

===========Security Intelligence============ Vendor Homepage: adobe.com Version: 2018 Tested on: Adobe ColdFusion 2018 Exploit Author: Pankaj Kumar Thakur Nepal ==========Table of Contents============== Overview Detailed description Thanks & Acknowledgements References ==========Vulnerability...

Adobe ColdFusion CKEditor Directory Traversal (CVE-2018-15960)

A directory traversal vulnerability exists in Adobe ColdFusion CKEditor component. The vulnerability is due improper sanitation of paths before writing files. Successful exploitation of this vulnerability could allow an attacker to write files to arbitrary locations on the target system...

Adobe ColdFusion Remote Code Execution (CVE-2019-7839)

A remote code execution vulnerability exists in Adobe ColdFusion. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Coldfusion / JNBridge Remote Code Execution Exploit

Coldfusion versions 2016 and 2018 along with all current versions of JNBridge suffer from a remote code execution vulnerability. Product: Coldfusion/JNBridge Manufacturer: Adobe/JNBridge LLC Affected Versions: Coldfusion 2016,2018, JNBridge all versions Tested Versions: 2018 Vulnerability Type:...

Adobe ColdFusion < 11.x < 11u19 / 2016.x < 2016u11 / 2018.x < 2018u4 Multiple Vulnerabilities (APSB19-27)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 11.x update 19, 2016.x update 11, or 2018.x update 4. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB19-27 advisory. - File extension blacklist bypass potentially leading to Arbitrary...

Design/Logic Flaw

ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2019-7839

ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2019-7840

ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2019-7838

ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead to arbitrary code execution...