CVE-2025-49541

CVE-2025-49541 – Adobe ColdFusion : Stored XSS affecting ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier. The vulnerability allows a high-privilege attacker to inject malicious scripts into vulnerable form fields, with malicious JavaScript potentially executed in a victim’s browser when ...

CVE-2025-49537

CVE-2025-49537 concerns Adobe ColdFusion. Affected are ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier, where an OS Command Injection flaw could allow arbitrary code execution by a high-privileged attacker. Exploitation requires user interaction, and the vulnerable component is restricte...

CVE-2025-49537 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

CVE-2025-49546

CVE-2025-49546 affects Adobe ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier with an Improper Access Control that can lead to a partial application denial-of-service. A high-privileged attacker could disrupt availability without user interaction, and the vulnerable component is restricte...

CVE-2025-49546 ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application...

CVE-2025-49543 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2025-49543 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2025-49540 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2025-49540

CVE-2025-49540 describes a stored Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion affecting versions 2025.2, 2023.14, 2021.20 and earlier. The issue allows a high-privileged attacker to inject malicious scripts into vulnerable form fields, with malicious JavaScript executed in a vict...

PT-2025-28753 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is related to an Improper Access Control vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerabili...

PT-2025-28754 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is related to the use of hard-coded credentials, which could result in privilege escalation. An attacker could leverage this to gain unauthorized access to...

Free certificates for IP addresses: security problem or solution?

Let’s Encrypt has announced its issued its first certificate for an IP address. Why that’s significant deserves a little explanation. You may have run into Let’s Encrypt certificates many times without realizing it. When you see a padlock icon in your browser’s address bar, it means the site is...

Net::IP::LPM 安全漏洞

Net::IP::LPM is a Perl module by Tomas Podermanski, a personal developer, that implements the Longest Prefix Matching LPM algorithm. A security vulnerability exists in Net::IP::LPM version 1.10 that stems from not properly handling IP address leading zeros, which could lead to an access control...

INTERPOL Dismantles 20,000+ Malicious IPs Linked to 69 Malware Variants in Operation Secure

INTERPOL on Wednesday announced the dismantling of more than 20,000 malicious IP addresses or domains that have been linked to 69 information-stealing malware variants. The joint action, codenamed Operation Secure, took place between January and April 2025, and involved law enforcement agencies...

Spoofing Attack

org.springframework.cloud, spring-cloud-gateway-server is vulnerable to Spoofing Attack. The vulnerability is due to insufficient validation of X-Forwarded-For and Forwarded headers from untrusted proxies, allowing attackers to spoof client IP addresses...

CVE-2023-41591

An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communications between fake and real hosts...

XenServer - How to change the management IP addresses of all hosts in the pool

This article describes how to change the management IP address of all hosts in the pool...

CVE-2024-1340

The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generateexportfile function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and...

CVE-2023-25913

Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information...

CVE-2023-51451

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...