CveMateVulnerability intelligence

Adobe Coldfusion vulnerabilities, page 3

285 vulnerabilities

Known vulnerabilities in Adobe Coldfusion, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2018-15960adobecoldfusion8y ago25-09-2018 13:00

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to arbitrary file overwrite.CVE-2018-15965adobecoldfusion8y ago25-09-2018 13:00

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.CVE-2018-15959adobecoldfusion8y ago25-09-2018 13:00

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.CVE-2018-15957adobecoldfusion8y ago25-09-2018 13:00

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.CVE-2013-1389adobecoldfusion13y ago16-05-2013 10:00

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2013-1388adobecoldfusion13y ago10-04-2013 01:00

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.CVE-2013-1387adobecoldfusion13y ago10-04-2013 01:00

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.CVE-2013-0625adobecoldfusionKEV13y ago09-01-2013 01:00

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.CVE-2013-0629adobecoldfusionKEV13y ago09-01-2013 01:00

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.CVE-2013-0632adobecoldfusionKEV13y ago17-01-2013 00:00

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.CVE-2013-0631adobecoldfusionKEV13y ago09-01-2013 01:00

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.CVE-2013-5326adobecoldfusion12y ago13-11-2013 01:00

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory is available, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the logviewer directory.CVE-2013-5328adobecoldfusion12y ago13-11-2013 01:00

Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors.CVE-2013-3336adobecoldfusion13y ago09-05-2013 10:00

Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.CVE-2013-3349adobecoldfusion13y ago10-07-2013 10:00

Unspecified vulnerability in Adobe ColdFusion 9.0 through 9.0.2, when the JRun application server is used, allows remote attackers to cause a denial of service via unknown vectors.CVE-2013-3350adobecoldfusion13y ago10-07-2013 10:00

Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets.CVE-2021-21087adobecoldfusion5y ago15-04-2021 13:54

Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.CVE-2021-40698adobecoldfusion3y ago07-09-2023 12:54

ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass  . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.CVE-2021-40699adobecoldfusion3y ago07-09-2023 12:54

ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.CVE-2015-0345adobecoldfusion11y ago15-04-2015 10:00

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.