CVE-2018-15962: Exposure of Sensitive Information to an Unauthorized Actor

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability. Successful exploitation could lead to information disclosure...

CVE-2018-15961: Unrestricted Upload of File with Dangerous Type

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2018-15965: Deserialization of Untrusted Data

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution...

Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18735)

Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...

Adobe ColdFusion 11.x < 11u15 / 2016.x < 2016u7 / 2018.x < 2018u1 Multiple Vulnerabilities (APSB18-33)

The version of Adobe ColdFusion running on the remote Windows host is 11.x prior to update 15, 2016.x prior to update 7 or 2018.x prior to update 1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117480;...

Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18736)

Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...

Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18737)

Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...

Adobe ColdFusion Security Bypass Vulnerability (CNVD-2018-18739)

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. A security bypass vulnerability exists in Adobe ColdFusion. An attacker could exploit the vulnerability to bypass security...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2018-18731)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An information disclosure vulnerability exists in Adobe ColdFusion. An attacker could exploit the...

Adobe ColdFusion Arbitrary File Upload Vulnerability

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file upload vulnerability exists in Adobe ColdFusion. An attacker can exploit the vulnerability to upload arbitrary...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2018-18738)

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An information disclosure vulnerability exists in Adobe ColdFusion. An attacker could exploit the vulnerability to disclose sensiti...

Adobe ColdFusion Arbitrary File Rewrite Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file rewrite vulnerability exists in Adobe ColdFusion. An attacker could overwrite arbitrary...

Adobe ColdFusion Arbitrary Code Execution Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. There is a security vulnerability in Adobe ColdFusion that stems from the program deserializing untrustworth...

Adobe ColdFusion Multiple Vulnerabilities (APSB18-33)

Adobe ColdFusion is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:coldfusion";...

September 2018 Patch Tuesday – 61 Vulns, FragmentSmack, Hyper-V Escape

In this month’s Patch Tuesday release there are 61 vulnerabilities patched with 17 Criticals. Out of the criticals, most are browser-related, with the rest including Windows, Hyper-V, and .net Framework. A vulnerability CVE-2018-8475 in Windows' image parsing has been publicly disclosed, in...

Adobe Issues ColdFusion Software Update for 6 Critical Vulnerabilities

Adobe has released September 2018 security patch updates for a total of 10 vulnerabilities in Flash Player and ColdFusion, six of which are rated as critical that affected ColdFusion and could allow attackers to remotely execute arbitrary code on a vulnerable server. What's the good news this mon...

Adobe Patches Six Critical Flaws in ColdFusion

Adobe has released patches fixing six critical vulnerabilities in its ColdFusion product that could lead to arbitrary code-execution. The flaws impact Adobe’s ColdFusion product, which is the company’s commercial web application development platform. Impacted are the 2016 Update 6 and earlier...

Adobe ColdFusion CKEditor unrestricted file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Tested on Adobe ColdFusion...

PT-2018-3484

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions July 12 release 2018.0.0.310739 through Update 6 Adobe ColdFusion versions July 12 release 2018.0.0.310739 through Update 14 Description: The issue is related to an unrestricted file upload vulnerability in the...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Flash Player and ColdFusion. An attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review Adobe Security Bulletins APSB18-31 and APSB18-33...