PT-2025-32867 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.9-alpha1 through 2.4.4-p14 Description: Adobe Commerce is affected by a Time-of-check Time-of-use TOCTOU race condition. This issue could allow a security feature to be bypassed, potentially leading to unauthorized...

CVE-2025-49559: Improper Limitation of a Pathname to a Restricted Directory

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a security feature bypass. An attacker could leverage this...

CVE-2025-49558: Time-of-check Time-of-use (TOCTOU) Race Condition

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability by manipulating the...

CVE-2025-49556: Incorrect Authorization

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2024-38434

Summary IBM Engineering Systems Design Rhapsody was vulnerable to use of Potentially Dangerous Function which may allow security feature bypass Vulnerability Details CVEID:CVE-2024-38434 DESCRIPTION: Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature...

Adobe ColdFusion XXE Vulnerability

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from an XXE vulnerability that can be exploited by attackers to cause a securi...

Adobe ColdFusion XML External Entity Injection Vulnerability (CNVD-2025-16375)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has an XML external entity injection vulnerability that originates from improperly...

CVE-2025-47182

Improper input validation in Microsoft Edge Chromium-based allows an authorized attacker to bypass a security feature locally...

CVE-2025-47182: Improper Input Validation

Improper input validation in Microsoft Edge Chromium-based allows an authorized attacker to bypass a security feature locally...

CVE-2025-49536

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of...

CVE-2025-49535

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service b...

CVE-2025-48804

Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...

CVE-2025-48003

Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...

CVE-2025-48814

Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a network...

CVE-2025-49536

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of...

CVE-2025-49535 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service b...

CVE-2025-49535

CVE-2025-49535 describes an XXE vulnerability in Adobe ColdFusion for versions 2025.2, 2023.14, 2021.20 and earlier. The issue is an improper restriction of XML External Entity references, which could allow an attacker to access sensitive information or cause denial of service. Exploitation requi...

CVE-2025-49536 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of...

CVE-2025-49536

The CVE-2025-49536 issue affects Adobe ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier and is an Incorrect Authorization vulnerability that can bypass security features. A low-privileged attacker could bypass security checks and gain unauthorized access without user interaction, with exp...

CVE-2025-49539 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information...