CVE-2023-38205

CVE-2023-38205 affects Adobe ColdFusion: versions 2018u18 and earlier, 2021u8 and earlier, and 2023u2 and earlier are vulnerable to an Improper Access Control flaw that enables an unauthenticated attacker to bypass security and access the administration CFM/CFC endpoints without user interaction....

CVE-2018-15961

CVE-2018-15961 affects Adobe ColdFusion 2018 (July 12 release 2018.0.0.310739) and Update 6 and earlier, and Update 14 and earlier. The vulnerability is an unrestricted file upload via CKEditor (upload.cfm) that could allow remote attackers to upload arbitrary files and execute code on the affect...

CVE-2023-26360

Adobe ColdFusion CVE-2023-26360 is an Improper Access Control vulnerability that could enable arbitrary code execution in the context of the current user. Affected products include ColdFusion 2018 Update 15 and earlier and ColdFusion 2021 Update 5 and earlier; exploitation does not require user i...

CVE-2023-26359

CVE-2023-26359 affects Adobe ColdFusion 2018 Update 15 and earlier, and 2021 Update 5 and earlier, via a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution in the current user context. Exploitation does not require user interaction. Publicly available deta...

CVE-2023-29298

Adobe ColdFusion is affected by CVE-2023-29298, a unauthenticated Improper Access Control vulnerability that could bypass security features to reach the administration CFM/CFC endpoints. Affected versions include ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier....

CVE-2023-29300

CVE-2023-29300 is an Adobe ColdFusion deserialization of untrusted data vulnerability affecting ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. The flaw allows arbitrary code execution without user interaction, via a network vector (CVSS v3.1: AV:N/AC:L/PR:N/U...

CVE-2023-38203

Adobe ColdFusion CVE-2023-38203 is a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution. Affected: ColdFusion 2018u17 and earlier, 2021u7 and earlier, 2023u1 and earlier. Exploitation does not require user interaction; CVSSv3.1 base score 9.8 (CRITICAL) wi...

CVE-2021-21087

Adobe ColdFusion is affected by CVE-2021-21087: an Improper Neutralization of Input During Web Page Generation (XSS) in CF2016 (before 2016u17), CF2018 (before 2018u11), and CF2021 (before 2021u1). The vulnerability allows an attacker to execute arbitrary JavaScript in the context of the current ...

CVE-2019-7839

Adobe ColdFusion is affected by a command injection vulnerability (CVE-2019-7839) in Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier. Successful exploitation could result in arbitrary code execution. The issue is documented across multiple sources in 2019 advisories (e.g., ...

CVE-2023-38206

Adobe ColdFusion is affected by CVE-2023-38206: improper access control allowing an attacker to access administration CFM/CFC endpoints with no interaction, causing low confidentiality impact. Affected: ColdFusion versions 2018u18 and earlier, 2021u8 and earlier, 2023u2 and earlier. Exploitation ...

CVE-2023-38204

CVE-2023-38204 affects Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier, and 2023u2 and earlier. The vulnerability is a Deserialization of Untrusted Data issue that could lead to Arbitrary code execution, with no user interaction required. The root cause is unsafe deserialization...

CVE-2023-26361

CVE-2023-26361 is an Adobe ColdFusion path-traversal vulnerability affecting 2018 Update 15 and earlier and 2021 Update 5 and earlier, enabling Arbitrary file system read. Exploitation does not require user interaction but requires administrator privileges. Remediation per APSB23-25 is to apply t...

CVE-2019-7838

Adobe ColdFusion prior to updates 11.x/2016.x/2018.x are vulnerable to CVE-2019-7838 due to a file extension blacklist bypass, enabling arbitrary code execution on successful exploitation. The Red Hat/NVD/Nessus entries confirm the same issue and indicate remediation by updating to affected patch...

CVE-2019-8256

Adobe ColdFusion is affected by CVE-2019-8256 due to insecure inherited permissions of the default installation directory, enabling privilege escalation. Public details across connected sources indicate affected versions include ColdFusion installations older than 2018u7 (e.g.,

CVE-2019-7840

CVE-2019-7840 affects Adobe ColdFusion. The vulnerability is caused by deserialization of untrusted data in ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier, with the potential for arbitrary code execution on successful exploitation (impact: high). Public...

CVE-2022-28818

CVE-2022-28818 is a reflected Cross‑Site Scripting vulnerability affecting Adobe ColdFusion 2021 (CF2021U3 and earlier) and ColdFusion 2018 (CF2018U13). The issue arises from improper handling of user-supplied input in vulnerable pages, allowing malicious JavaScript to execute in a victim’s brows...

CVE-2022-35712

CVE-2022-35712 is a heap-based buffer overflow affecting Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier). The vulnerability can lead to arbitrary code execution in the context of the current user and is triggered by a crafted network packet sent to the server, with no...

CVE-2020-9673

CVE-2020-9673 affects Adobe ColdFusion 2016 (Update 15 and earlier) and ColdFusion 2018 (Update 9 and earlier) due to a DLL search-order hijacking vulnerability that could enable privilege escalation. Public sources corroborate that patches are released under APSB20-43, with advisories noting upd...

CVE-2022-38418

CVE-2022-38418 affects Adobe ColdFusion versions Update 14 and earlier, and Update 4 and earlier. The issue is an improper limitation of a pathname to a restricted directory (path traversal) that could allow arbitrary code execution in the context of the current user. Exploitation does not requir...

CVE-2019-7091

CVE-2019-7091 is an Adobe ColdFusion deserialization vulnerability (deserialization of untrusted data) that allows arbitrary code execution. Affected products, per connected documents, are ColdFusion 2018 Update 1 and earlier, ColdFusion 2016 Update 7 and earlier, and ColdFusion 11 Update 15 and ...

CVE-2019-7092

Adobe ColdFusion is affected by CVE-2019-7092 (XSS leading to information disclosure). The issue impacts ColdFusion 2018 (update 1 and earlier), 2016 (update 7 and earlier), and ColdFusion 11 (update 15 and earlier). The Root cause is cross-site scripting in the ColdFusion component. Remediation ...

CVE-2019-8073

The CVE-2019-8073 issue affects Adobe ColdFusion: ColdFusion 2018 Update 4 and earlier and ColdFusion 2016 Update 11 and earlier are vulnerable to a command-injection via a vulnerable component that could allow arbitrary code execution in the context of the current user. The vulnerability is addr...

CVE-2019-7816

CVE-2019-7816 affects Adobe ColdFusion: Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier. The issue is a file upload restriction bypass that could allow arbitrary code execution on a vulnerable system. The vulnerability is described across multiple sources in the Connected do...

CVE-2022-38422

Adobe ColdFusion is affected by CVE-2022-38422, a path traversal information disclosure vulnerability in Update 14 and earlier and Update 4 and earlier. Root cause is Improper Limitation of a Pathname to a Restricted Directory, enabling unauthenticated remote attackers to disclose sensitive infor...

CVE-2022-38424

CVE-2022-38424 affects Adobe ColdFusion Update 14 and earlier and Update 4 and earlier. The issue is an improper limitation of a pathname to a restricted directory (path traversal) that could enable arbitrary file system write. Exploitation is described as requiring administrator privileges with ...

CVE-2022-38420

CVE-2022-38420 affects Adobe ColdFusion Update 14 and earlier, and Update 4 and earlier. It is a Use of Hard-coded Credentials vulnerability that could cause application denial-of-service by granting access to start/stop arbitrary services; exploitation does not require user interaction. Widely c...

CVE-2023-29301

CVE-2023-29301 affects Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. It is an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass and could impact user confidentiality. Exploit...

CVE-2018-15957

CVE-2018-15957 affects Adobe ColdFusion (2018 July 12 release 2018.0.0.310739; Update 6 and earlier; Update 14 and earlier) with a deserialization of untrusted data flaw that can lead to arbitrary code execution. Connected sources also reference explicit remediation: upgrade to ColdFusion 2018 Up...

CVE-2022-42341

CVE-2022-42341 – Adobe ColdFusion XXE vulnerability . Affected: ColdFusion Update 14 (and earlier) and Update 4 (and earlier). Root cause: improper restriction of XML External Entity references (XXE) allowing an attacker to read arbitrary files on the server via XML processing. Impact: arbitrary ...

CVE-2022-42340

Adobe ColdFusion is affected by CVE-2022-42340 due to an Improper Input Validation vulnerability that enables arbitrary file system reads. According to the connected advisories, the issue impacts ColdFusion versions prior to the security updates in APSB22-44 (notably older Update 14 and Update 4 ...

CVE-2020-10145

CVE-2020-10145 affects the Adobe ColdFusion installer on Windows, which fails to set a secure ACL on the default installation directory (e.g., C:\ColdFusion2021). This allows unprivileged users to place files in the ColdFusion install path, enabling privilege escalation. Exploitation details are ...

CVE-2022-38423

CVE-2022-38423 affects Adobe ColdFusion (versions Update 14 and earlier, Update 4 and earlier). It is a Path Traversal vulnerability that could disclose information by improper restriction of pathnames. Exploitation does not require user interaction but requires administrator privileges, per the ...

CVE-2019-8072

CVE-2019-8072 affects Adobe ColdFusion 2018 (update 4 and earlier) and ColdFusion 2016 (update 11 and earlier). The flaw is a security bypass that could lead to information disclosure in the context of the current user. Connected sources also indicate remediation via upgrading to ColdFusion 2018 ...

CVE-2021-40699

CVE-2021-40699 affects Adobe ColdFusion 2021 update 1 and earlier and ColdFusion 2018.10 and earlier. The issue is an improper access control in the CFIDE path that could let an authenticated attacker access and manipulate arbitrary data in the environment. The vulnerability is mapped to a high s...

CVE-2018-15962

Adobe ColdFusion is affected by a directory listing vulnerability (CVE-2018-15962). Impacted are ColdFusion 2016 Update 6 and earlier, the 2018-07-12 release (2018.0.0.310739) and Update 14 and earlier, and ColdFusion 11 Update 14 and earlier. Successful exploitation could disclose sensitive info...

CVE-2020-3767

CVE-2020-3767 applies to Adobe ColdFusion 2016 (updates up to 15) and ColdFusion 2018 (updates up to 9). The issue is an insufficient input validation vulnerability that could cause an application‑level DoS. Public sources in the connected set confirm the affected products and the root cause, wit...

CVE-2020-3794

CVE-2020-3794 affects Adobe ColdFusion 2016 and 2018. The issue is a file inclusion vulnerability that could allow an attacker to execute arbitrary code by loading files located in the webroot or its subdirectories. Public advisories and vendor listings (NVD, Red Hat, CNVD, CVE records, and APSB2...

CVE-2022-35711

CVE-2022-35711 affects Adobe ColdFusion Update 14 and earlier and Update 4 and earlier. It is a heap-based buffer overflow triggered by a crafted network packet, enabling arbitrary code execution in the context of the current user without user interaction. Publicly documented remediation is to ap...

CVE-2022-38419

CVE-2022-38419 affects Adobe ColdFusion Update 14 (and earlier) and Update 4 (and earlier) with an XML External Entity (XXE) vulnerability that could cause arbitrary file system reads. Exploitation requires no user interaction. Public records highlight a fix path via APSB22-44 security updates fo...

CVE-2020-3768

Adobe ColdFusion 2016 (pre-Update 15) and ColdFusion 2018 (pre-Update 9) are affected by CVE-2020-3768 due to a DLL search-order hijack that could enable local privilege escalation. The issue stems from DLL loading order on Windows; exploitation is local and could grant elevated privileges. Remed...

CVE-2020-3796

CVE-2020-3796 affects Adobe ColdFusion 2016 and ColdFusion 2018. The root cause is improper access control that could allow an attacker to disclose the underlying system file structure. Affected products include ColdFusion 2016 before update 15 and ColdFusion 2018 before update 9 (per APSB20-18 a...

CVE-2020-9672

CVE-2020-9672 affects Adobe ColdFusion 2016 (update 15 and earlier) and ColdFusion 2018 (update 9 and earlier). The issue is a DLL search-order hijacking vulnerability that could lead to privilege escalation. Public documentation references vendor advisories APSB20-43 and related patches; remedia...

CVE-2022-35690

CVE-2022-35690 is a stack-based buffer overflow in the Adobe ColdFusion ODBC Agent affecting ColdFusion versions Update 14 and earlier and Update 4 and earlier. The issue is triggered by a crafted network packet and can lead to arbitrary code execution in the context of the current user without u...

CVE-2019-8074

CVE-2019-8074 is a path traversal vulnerability in Adobe ColdFusion 2018 (update 4 and earlier) and ColdFusion 2016 (update 11 and earlier) that could bypass access controls in the context of the current user. NVD CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction...

CVE-2022-38421

Adobe ColdFusion (versions Update 14 and earlier, and Update 4 and earlier) is affected by a Path Traversal vulnerability that allows arbitrary code execution in the context of the current user. Exploitation requires administrator privileges (per the CVE description) and, per ZDI, authentication ...

CVE-2018-15964

CVE-2018-15964 affects Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier, due to a vulnerable component leading to information disclosure. CVSS indicates high confidentiality impact (C:H/I:N/A:N; network attack). The issue was among multi...

CVE-2018-15960

CVE-2018-15960 affects Adobe ColdFusion (2018 July 12 release and earlier 2018 updates; also ColdFusion 11 Update 14 and earlier/2016 Update 6 and earlier). The connected advisory CPAI-2019-0985 identifies CKEditor Directory Traversal in the ColdFusion CKEditor component, due to improper sanitiza...

CVE-2022-35710

CVE-2022-35710 affects Adobe ColdFusion Update 14 and earlier, and Update 4 and earlier, via a stack-based buffer overflow in the ODBC/ColdFusion server component triggered by a crafted network packet. This can lead to remote arbitrary code execution in the context of the current user, with no us...

CVE-2018-15959

CVE-2018-15959 describes an insecure deserialization vulnerability in Adobe ColdFusion. The issue affects ColdFusion versions released July 12, 2018 (2018.0.0.310739) and Update 6 and earlier, as well as Update 14 and earlier, where deserializing untrusted data can lead to arbitrary code executio...

CVE-2018-15963

Adobe ColdFusion 2016 Update 6 and earlier, ColdFusion 11 Update 14 and earlier, and the July 12, 2018 release (2018.0.0.310739) are affected by CVE-2018-15963, a security bypass that could allow arbitrary folder creation. The vulnerability stems from a bypass in ColdFusion’s security controls an...