CVE-2024-41874 ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which whe...

CVE-2024-45113 ColdFusion | Improper Authentication (CWE-287)

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does...

CVE-2024-45113

CVE-2024-45113 affects ColdFusion versions 2023.6, 2021.12 and earlier, introducing an Improper Authentication vulnerability that can lead to privilege escalation. An attacker could gain unauthorized access without user interaction, with a network attack vector and no required privileges. The bas...

CVE-2024-45113 ColdFusion | Improper Authentication (CWE-287)

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does...

Adobe ColdFusion 授权问题漏洞

Adobe ColdFusion is a suite of rapid application development platforms from the American company Audobee Adobe. The platform includes an integrated development environment and a scripting language. Adobe ColdFusion 2023.6, prior to version 2021.12 has an authorization issue vulnerability that ste...

Adobe ColdFusion < 2021.x < 2021u16 / 2023.x < 2023u10 Vulnerability (APSB24-71)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2021.x update 16 or 2023.x update 10. It is, therefore, affected by a vulnerability as referenced in the APSB24-71 advisory. - Deserialization of Untrusted Data CWE-502 potentially leading to Arbitrary code execution...

Adobe ColdFusion 代码问题漏洞

Adobe ColdFusion is a suite of rapid application development platforms from the American company Audobee Adobe. The platform includes an integrated development environment and a scripting language. A code issue vulnerability exists in Adobe ColdFusion versions 2023.x through prior to 2023.10 and...

Adobe Releases Security Updates for Multiple Products

Adobe released security updates to address multiple vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the...

PT-2024-6352 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2023.9, 2021.15 and earlier Description: The issue is related to a Deserialization of Untrusted Data vulnerability, which could result in arbitrary code execution in the context of the current user. An attacker could explo...

APSB24-71 : Security update available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2023 and 2021. These updates resolve a critical vulnerability that could lead to arbitrary code execution...

Adobe XML External Entity Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe XML External Entity Injection', 'Description' = %q Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2...

ColdFusion Server Check

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ColdFusion Server Check', 'Description' = %q This module attempts to exploit the directory traversal in the 'locale' attribute. According to the...

CVE-2024-20767 Adobe Coldfusion Arbitrary File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read', 'Description' = %q This module exploits an Improper Access Vulnerability in Adobe...

ColdFusion password.properties Hash Extraction

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ColdFusion 'password.properties' Hash Extraction", 'Description' = %q This module uses a directory traversal vulnerability to extract information...

Adobe ColdFusion Unauthenticated Arbitrary File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe ColdFusion Unauthenticated Arbitrary File Read', 'Description' = %q This module exploits a remote unauthenticated deserialization of...

FarCry Core Framework Security Vulnerability

FarCry Core Framework is a ColdFusion language web application framework open-sourced by FarCry Core. A security vulnerability exists in FarCry Core Framework versions prior to 7.2.14, which originates from an arbitrary file upload vulnerability in /fileupload/upload.cfm. An attacker can use this...

The vulnerability of the ColdFusion software platform, related to weak cryptography for passwords, allows attackers to circumvent existing security restrictions and gain unauthorized access to protected information.

The vulnerability of the ColdFusion software platform is related to the weak cryptography used for passwords. Exploiting this vulnerability allows attackers to bypass existing security restrictions and gain unauthorized access to protected information...

The vulnerability of the ColdFusion software platform, related to improper access control, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the ColdFusion software platform is related to improper access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Adobe ColdFusion Weak Algorithm Vulnerability

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from a weak algorithmic vulnerability that stems from the presence of weak...

Adobe ColdFusion Access Control Error Vulnerability (CNVD-2024-34094)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from an Access Control Error vulnerability that originates from improper acces...