December 2019 Patch Tuesday – 36 Vulns, 7 Critical, Actively Attacked Win32k vuln, Adobe vulns

This month's Patch Tuesday is rather light and addresses 36 vulnerabilities, with only 7 labeled as Critical. Five of the seven Critical vulns are in Git for Visual Studio. The others are for Hyper-V and Win32k. Also, there is one actively attacked "Important" vuln in Win32k. Adobe released patch...

Adobe Releases Patches for 'Likely Exploitable' Critical Vulnerabilities

The last Patch Tuesday of 2019 is finally here. Adobe today released updates for four of its widely used software—including Adobe Acrobat and Reader, Photoshop CC, ColdFusion, and Brackets—to patch a total of 25 new security vulnerabilities. Seventeen of these flaws have been rated as critical in...

Adobe Releases Patches for 'Likely Exploitable' Critical Vulnerabilities

The last Patch Tuesday of 2019 is finally here. Adobe today released updates for four of its widely used software—including Adobe Acrobat and Reader, Photoshop CC, ColdFusion, and Brackets—to patch a total of 25 new security vulnerabilities. Seventeen of these flaws have been rated as critical in...

Adobe Fixes 17 Critical Acrobat, Photoshop and Brackets Flaws

Adobe Systems is stomping out 17 critical vulnerabilities in Acrobat Reader, Photoshop and Brackets, which could lead to arbitrary code execution if exploited. Overall, Adobe released patches – as part of its regularly-scheduled updates – addressing 25 CVEs across various products, including its...

Adobe ColdFusion CVE-2019-8256 Remote Privilege Escalation Vulnerability

Description Adobe ColdFusion is prone to a remote privilege-escalation vulnerability. An attacker may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Technologies Affected Adobe ColdFusion 10 Adobe ColdFusion 10 Update 1 Adobe ColdFusion 10 Update 1...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the...

PT-2019-5913

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions Update 6 and earlier Description The issue is related to errors in using standard permissions, specifically an insecure inherited permissions vulnerability of the default installation directory. This could allow an...

APSB19-58 Security update available for Adobe ColdFusion

Adobe has released security updates for ColdFusion version 2018. This update resolves an important vulnerability that could lead to privilege escalation...

Adobe ColdFusion Insecure Deserialization (CVE-2019-7091)

An insecure deserialization vulnerability exists in Adobe ColdFusion. This vulnerability is due to the lack of input validation of the JavaAdapter and JavaBeanAdapter classes. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected...

Adobe ColdFusion RDS Authentication Bypass Vulnerability

Adobe ColdFusion is a dynamic Web server with CFML ColdFusion Markup Language, a programming language. An authentication bypass vulnerability exists in Adobe ColdFusion RDS, which arises from a lack of authentication measures or insufficient authentication strength in a networked system or produc...

Adobe ColdFusion RDS Authentication Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe ColdFusion RDS Authentication Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass...

Adobe ColdFusion File Upload (APSB18-33) (CVE-2018-15961)

An arbitrary file upload vulnerability exists in Adobe ColdFusion due to insufficient validation in the filemanager plugin. An unauthenticated, remote attacker can exploit this, via a specially crafted POST request, to upload arbitrary files on the remote host. TRUSTED...

ColdFusion Path Traversal

The vulnerability of the ColdFusion software platform is related to errors in restricting the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system remotely...

October 2019 Patch Tuesday – 59 vulns, 9 Critical, Azure App Service, Remote Desktop Client, PoC for Windows Error Reporting

This month’s Microsoft Patch Tuesday addresses 59 vulnerabilities with only 9 of them labeled as Critical. Of the 9 Critical vulns, 7 of them are for browsers and scripting engines. The remaining 2 are for Azure App Service and Remote Desktop Client. In addition, PoC code has been published for a...

CVE-2019-8072

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user...

CVE-2019-8073

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user...

CVE-2019-8074

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user...

CVE-2019-8073

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user...

CVE-2019-8074

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user...

CVE-2019-8072

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user...