Security feature bypass

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user...

Command injection

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user...

Path traversal

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user...

CVE-2019-8074

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user...

CVE-2019-8074

CVE-2019-8074 is a path traversal vulnerability in Adobe ColdFusion 2018 (update 4 and earlier) and ColdFusion 2016 (update 11 and earlier) that could bypass access controls in the context of the current user. NVD CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction...

CVE-2019-8073

The CVE-2019-8073 issue affects Adobe ColdFusion: ColdFusion 2018 Update 4 and earlier and ColdFusion 2016 Update 11 and earlier are vulnerable to a command-injection via a vulnerable component that could allow arbitrary code execution in the context of the current user. The vulnerability is addr...

CVE-2019-8073

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user...

CVE-2019-8072

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user...

CVE-2019-8072

CVE-2019-8072 affects Adobe ColdFusion 2018 (update 4 and earlier) and ColdFusion 2016 (update 11 and earlier). The flaw is a security bypass that could lead to information disclosure in the context of the current user. Connected sources also indicate remediation via upgrading to ColdFusion 2018 ...

CVE-2019-8074: Improper Limitation of a Pathname to a Restricted Directory

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user...

Adobe ColdFusion 2016.x < 2016u12 / 2018.x < 2018u5 Multiple Vulnerabilities (APSB19-47)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2016.x update 12 or 2018.x update 5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB19-47 advisory: - An unspecified command injection vulnerability via a vulnerable component could...

CVE-2019-8073: Improper Neutralization of Special Elements used in a Command

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user...

CVE-2019-8072: Undefined Security Weakness

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user...

Adobe ColdFusion Multiple Vulnerabilities (APSB19-47)

Adobe ColdFusion is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:coldfusion"; if...

Adobe Releases Security Updates for ColdFusion

Adobe has released security updates to address vulnerabilities in ColdFusion. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review Adobe Security...

Command Execution Vulnerability in ColdFusion

Adobe ColdFusion is a commercial rapid development platform. It can be used as a development platform, as a Flash remote service or as a backend server for Adobe Flex applications. A command execution vulnerability exists in ColdFusion. An attacker could exploit this vulnerability to gain...

Adobe Unscheduled Update Fixes Critical ColdFusion Flaws

Adobe has issued an unscheduled security update that fixes two critical flaws in its ColdFusion product. The critical vulnerabilities could enable an attacker to either execute arbitrary code or bypass access control on impacted systems. Overall, Adobe released three patches – one for an...

PT-2019-3371

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2018 update 4 and earlier ColdFusion versions 2016 update 11 and earlier Description The issue is related to the possibility of injecting external commands through a vulnerable module of the ColdFusion platform. This could...

APSB19-47 Security updates available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2018 and 2016. These updates resolve two critical and one important vulnerability that could lead to arbitrary code execution...

PT-2019-3372

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2018 update 4 and earlier ColdFusion versions 2016 update 11 and earlier Description The issue is related to path traversal errors in the ColdFusion platform, allowing a remote attacker to write arbitrary files to the...