Adobe ColdFusion

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe ColdFusion Improper Access Control Security feature bypass

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.

Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read

Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability

Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service

Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read

Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass

Adobe ColdFusion Improper Input Validation Arbitrary file system read

ColdFusion CFDOCUMENT file retrieval / access control bypass

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.

CVE-2023-38205 issues | ColdFusion Admin Panel Access

Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure.

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to arbitrary file overwrite.

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. Successful exploitation could lead to arbitrary file read from the coldfusion install directory.

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure.

Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725.

ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

ColdFusion | Improper Access Control (CWE-284)

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion | Improper Authentication (CWE-287)

ColdFusion | Improper Access Control (CWE-284)

ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass  

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion | Incorrect Authorization (CWE-863)

Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write

Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive information or possibly gain privileges, via unknown vectors.

Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/.

Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown vectors.