Security Hotfixes Available for Adobe ColdFusion

Adobe has released a security hotfix for ColdFusion 10 for Windows, Macintosh and Linux to address a vulnerability that could allow an attacker to cause an elevation of privilege condition. A security hotfix for Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 on JRun is available to address a vulnerabilit...

July 2013 Adobe Security Bulletins, Patches Released

Adobe today released its monthly round of security updates with patches available for Flash Player, Shockwave and ColdFusion. None of the vulnerabilities are being exploited in the wild, according to Adobe. The flaws in Flash Player and Shockwave could allow hackers to remotely install and run...

Adobe ColdFusion Multiple Vulnerabilities (APSB13-03) (credentialed check)

The version of Adobe ColdFusion running on the remote host is missing hotfixes that address the following vulnerabilities : - An authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. CVE-2013-0625 - A directory traversal vulnerability exis...

Adobe ColdFusion 远程代码执行漏洞(CVE-2013-1389)

BUGTRAQ ID: 59849 CVECAN ID: CVE-2013-1389 Adobe ColdFusion是一个动态Web服务器。 Adobe ColdFusion 10, 9.0.2, 9.0.1, 9.0存在远程代码执行漏洞，攻击者可利用此漏洞在当前用户上下文中执行任意代码。 0 Adobe ColdFusion 9.0.1 Adobe ColdFusion 9.0 厂商补丁： Adobe ----- Adobe已经为此发布了一个安全公告（apsb13-13）以及相应补丁: apsb13-13：Hotfix available for ColdFusion...

Adobe ColdFusion Directory Traversal Information Disclosure (APSA13-03; CVE-2013-3336)

A directory traversal vulnerability has been reported in Adobe ColdFusion. The vulnerability is due to a design weakness in the ColdFusion application. A remote attacker may exploit this issue to retrieve arbitrary files from the target system via directory traversal...

Adobe ColdFusion远程代码执行漏洞(CVE-2013-1389)

BUGTRAQ ID: 59849 CVECAN ID: CVE-2013-1389 Adobe ColdFusion是一个动态Web服务器。 Adobe ColdFusion 10, 9.0.2, 9.0.1, 9.0存在远程代码执行漏洞，攻击者可利用此漏洞在当前用户上下文中执行任意代码。 0 Adobe ColdFusion 9.0.1 Adobe ColdFusion 9.0 厂商补丁： Adobe ----- Adobe已经为此发布了一个安全公告（apsb13-13）以及相应补丁: apsb13-13：Hotfix available for ColdFusion...

CVE-2013-1389

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors...

Code injection

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors...

CVE-2013-1389

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors...

CVE-2013-1389

CVE-2013-1389 affects Adobe ColdFusion 10 and older 9.x versions (9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5) and allows remote code execution via unknown vectors. The root cause is an unspecified vulnerability that enables an attacker to run arbitrary code in the server ...

Adobe Patches ColdFusion Flaws Exploited in Wild

Exploits for vulnerabilities in Adobe’s ColdFusion application server have been at the heart of a number of incidents this year, including a compromise of servers belonging to the Washington State Court system. This level of action has prompted Adobe to release five security updates for the...

VulnCheck KEV: CVE-2013-1389

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors...

Adobe ColdFusion Authentication Bypass (APSB13-13)

The version of Adobe ColdFusion running on the remote host has an authentication bypass vulnerability. When RDS is disabled and not configured with password protection, it is possible to authenticate as an administrative user without providing a username or password. A remote, unauthenticated...

VulnCheck KEV: CVE-2013-3336

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors...

Coldfusion 8.0.1 文件上传漏洞

Coldfusion 最早是由 Macromedia公司的一种应用服务器平台，其coldfusion8.0.1版本存在文件上传漏洞，攻击者可以利用该漏洞上传Shell文件，从而控制整个站点。 Coldfusion 8.0.1...

Adobe ColdFusion 9 & 10 code injection vulnerability

Overview Adobe ColdFusion 9, 9.0.1, 9.0.2 with the APSB13-03 hotfix and 10 are vulnerable to a code injection vulnerability when ColdFusion is configured to not require authentication and RDS is disabled. Description Adobe ColdFusion is vulnerable to a code injection attack when RDS is disabled a...

Adobe ColdFusion Authentication Bypass (APSB13-13) (intrusive check)

The version of Adobe ColdFusion running on the remote host has an authentication bypass vulnerability. When RDS is disabled and not configured with password protection, it is possible to authenticate as an administrative user without providing a username or password. A remote, unauthenticated...

Adobe ColdFusion Multiple Vulnerabilities (APSA13-03)

The version of Adobe ColdFusion running on the remote host is affected by the following vulnerabilities : - A directory traversal vulnerability exists in /administrator/mail/download.cfm. A remote, authenticated attacker can exploit this issue to download arbitrary files. - A local file include...

Washington Court Data Breach Exposes 160K SSNs

Attackers using a vulnerability in Adobe’s ColdFusion app server were able to compromise servers belonging to the Washington State court system sometime in the last few months and walked off with data belonging to as many as a million residents of the state. The attackers had access to 160,000...

http-coldfusion-subzero NSE Script

Attempts to retrieve version, absolute path of administration panel and the file 'password.properties' from vulnerable installations of ColdFusion 9 and 10. This was based on the exploit 'ColdSub-Zero.pyFusion v2'. See also: http-adobe-coldfusion-apsa1301.nse http-vuln-cve2009-3960.nse...