Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18737)

Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...

Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18736)

Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...

Adobe ColdFusion 11.x < 11u15 / 2016.x < 2016u7 / 2018.x < 2018u1 Multiple Vulnerabilities (APSB18-33)

The version of Adobe ColdFusion running on the remote Windows host is 11.x prior to update 15, 2016.x prior to update 7 or 2018.x prior to update 1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117480;...

Adobe ColdFusion Arbitrary Code Execution Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. There is a security vulnerability in Adobe ColdFusion that stems from the program deserializing untrustworth...

Adobe ColdFusion Security Bypass Vulnerability (CNVD-2018-18739)

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. A security bypass vulnerability exists in Adobe ColdFusion. An attacker could exploit the vulnerability to bypass security...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2018-18731)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An information disclosure vulnerability exists in Adobe ColdFusion. An attacker could exploit the...

Adobe ColdFusion Arbitrary File Upload Vulnerability

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file upload vulnerability exists in Adobe ColdFusion. An attacker can exploit the vulnerability to upload arbitrary...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2018-18738)

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An information disclosure vulnerability exists in Adobe ColdFusion. An attacker could exploit the vulnerability to disclose sensiti...

Adobe ColdFusion Arbitrary File Rewrite Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file rewrite vulnerability exists in Adobe ColdFusion. An attacker could overwrite arbitrary...

Adobe ColdFusion Multiple Vulnerabilities (APSB18-33)

Adobe ColdFusion is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:coldfusion";...

September 2018 Patch Tuesday – 61 Vulns, FragmentSmack, Hyper-V Escape

In this month’s Patch Tuesday release there are 61 vulnerabilities patched with 17 Criticals. Out of the criticals, most are browser-related, with the rest including Windows, Hyper-V, and .net Framework. A vulnerability CVE-2018-8475 in Windows' image parsing has been publicly disclosed, in...

Adobe Issues ColdFusion Software Update for 6 Critical Vulnerabilities

Adobe has released September 2018 security patch updates for a total of 10 vulnerabilities in Flash Player and ColdFusion, six of which are rated as critical that affected ColdFusion and could allow attackers to remotely execute arbitrary code on a vulnerable server. What's the good news this mon...

Adobe Patches Six Critical Flaws in ColdFusion

Adobe has released patches fixing six critical vulnerabilities in its ColdFusion product that could lead to arbitrary code-execution. The flaws impact Adobe’s ColdFusion product, which is the company’s commercial web application development platform. Impacted are the 2016 Update 6 and earlier...

PT-2018-3484

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions July 12 release 2018.0.0.310739 through Update 6 Adobe ColdFusion versions July 12 release 2018.0.0.310739 through Update 14 Description: The issue is related to an unrestricted file upload vulnerability in the...

APSB18-33 Security updates available for ColdFusion

Adobe has released security updates for ColdFusion versions 2018, 2016 and 11. These updates resolve critical vulnerabilities that could lead to arbitrary code execution...

Adobe ColdFusion CKEditor unrestricted file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Tested on Adobe ColdFusion...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Flash Player and ColdFusion. An attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review Adobe Security Bulletins APSB18-31 and APSB18-33...

Rocke: The Champion of Monero Miners

This post was authored by David Liebenberg. Summary Cryptocurrency miners are becoming an increasingly significant part of the threat landscape. These malicious miners steal CPU cycles from compromised devices to mine cryptocurrencies and bring in income for the threat actor. In this post, we loo...

VulnCheck KEV: CVE-2017-3066

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution...

Adobe ColdFusion DataServicesCFProxy Insecure Deserialization (CVE-2018-4939)

An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...