Adobe ColdFusion 11.x < 11u15 / 2016.x < 2016u7 / 2018.x < 2018u1 Multiple Vulnerabilities (APSB18-33)

The version of Adobe ColdFusion running on the remote Windows host is 11.x prior to update 15, 2016.x prior to update 7 or 2018.x prior to update 1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117480;...

Adobe ColdFusion Arbitrary File Upload Vulnerability

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file upload vulnerability exists in Adobe ColdFusion. An attacker can exploit the vulnerability to upload arbitrary...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2018-18731)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An information disclosure vulnerability exists in Adobe ColdFusion. An attacker could exploit the...

Adobe ColdFusion Arbitrary File Rewrite Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file rewrite vulnerability exists in Adobe ColdFusion. An attacker could overwrite arbitrary...

Adobe ColdFusion Security Bypass Vulnerability (CNVD-2018-18739)

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. A security bypass vulnerability exists in Adobe ColdFusion. An attacker could exploit the vulnerability to bypass security...

Adobe ColdFusion Arbitrary Code Execution Vulnerability

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. There is a security vulnerability in Adobe ColdFusion that stems from the program deserializing untrustworth...

Adobe ColdFusion Information Disclosure Vulnerability (CNVD-2018-18738)

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An information disclosure vulnerability exists in Adobe ColdFusion. An attacker could exploit the vulnerability to disclose sensiti...

Adobe ColdFusion Multiple Vulnerabilities (APSB18-33)

Adobe ColdFusion is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:coldfusion";...

September 2018 Patch Tuesday – 61 Vulns, FragmentSmack, Hyper-V Escape

In this month’s Patch Tuesday release there are 61 vulnerabilities patched with 17 Criticals. Out of the criticals, most are browser-related, with the rest including Windows, Hyper-V, and .net Framework. A vulnerability CVE-2018-8475 in Windows' image parsing has been publicly disclosed, in...

Adobe Issues ColdFusion Software Update for 6 Critical Vulnerabilities

Adobe has released September 2018 security patch updates for a total of 10 vulnerabilities in Flash Player and ColdFusion, six of which are rated as critical that affected ColdFusion and could allow attackers to remotely execute arbitrary code on a vulnerable server. What's the good news this mon...

Adobe Patches Six Critical Flaws in ColdFusion

Adobe has released patches fixing six critical vulnerabilities in its ColdFusion product that could lead to arbitrary code-execution. The flaws impact Adobe’s ColdFusion product, which is the company’s commercial web application development platform. Impacted are the 2016 Update 6 and earlier...

PT-2018-3484 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions July 12 release 2018.0.0.310739 through Update 6 Adobe ColdFusion versions July 12 release 2018.0.0.310739 through Update 14 Description: The issue is related to an unrestricted file upload vulnerability in the...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Flash Player and ColdFusion. An attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review Adobe Security Bulletins APSB18-31 and APSB18-33...

Adobe ColdFusion CKEditor unrestricted file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Tested on Adobe ColdFusion...

APSB18-33 Security updates available for ColdFusion

Adobe has released security updates for ColdFusion versions 2018, 2016 and 11. These updates resolve critical vulnerabilities that could lead to arbitrary code execution...

Rocke: The Champion of Monero Miners

This post was authored by David Liebenberg. Summary Cryptocurrency miners are becoming an increasingly significant part of the threat landscape. These malicious miners steal CPU cycles from compromised devices to mine cryptocurrencies and bring in income for the threat actor. In this post, we loo...

VulnCheck KEV: CVE-2017-3066

Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution...

Adobe ColdFusion DataServicesCFProxy Insecure Deserialization (CVE-2018-4939)

An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

ColdFusion RCE(CVE-2018-4939)

In October 2017 I published an overview and video proof-of-concept of a Java RMI/deserialization vulnerability affecting the Flex Integration service of Adobe ColdFusion. I held off on publishing all of the details and exploit code at the time because I spotted an additional exploit payload that...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2018-10345)

Adobe ColdFusion is the United States of America Audobee Adobe a dynamic Web server products, which runs the CFML ColdFusion Markup Language is a programming language for Web applications. A cross-site scripting vulnerability exists in Adobe ColdFusion released in 2016 Update 5 and earlier versio...