Adobe ColdFusion

ColdFusion | Use of Hard-coded Credentials (CWE-798)

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion | Improper Input Validation (CWE-20)

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321)

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion | Improper Authentication (CWE-287)

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion | Improper Access Control (CWE-284)

ColdFusion | Uncontrolled Search Path Element (CWE-427)

ColdFusion | Uncontrolled Search Path Element (CWE-427)

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion | Heap-based Buffer Overflow (CWE-122)

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors.

Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability. Successful exploitation could lead to local privilege escalation.

The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion | Improper Input Validation (CWE-20)