Coldfusion

coldfusion

Vendor: Adobe • 241 CVEs

CVEs (241)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-38419 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read....Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.Show less
CVE-2022-38418 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary...Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.Show less
CVE-2022-35712 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Ex...Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.Show less
CVE-2022-35711 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Ex...Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.Show less
CVE-2022-35710 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. E...Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.Show less
CVE-2022-35690 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. E...Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.Show less
CVE-2022-28818 1Adobe 1Coldfusion Jun 17, 2026 May 12, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, mal...Show more ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2020-10145 1Adobe 1Coldfusion Jun 17, 2026 May 27, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structur...Show more The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.Show less
CVE-2021-21087 1Adobe 1Coldfusion Jun 17, 2026 Apr 15, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabili...Show more Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.Show less
CVE-2020-9673 1Adobe 1Coldfusion Jun 17, 2026 Jul 17, 2020 N/A· v4 7.8 HIGH· v3 4.4 MEDIUM· v2 Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2020-9672 1Adobe 1Coldfusion Jun 17, 2026 Jul 17, 2020 N/A· v4 7.8 HIGH· v3 4.4 MEDIUM· v2 Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2020-3796 1Adobe 1Coldfusion Jun 17, 2026 Jun 26, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability. Successful exploitation could lead to system file structure disclosure.
CVE-2020-3768 1Adobe 1Coldfusion Jun 17, 2026 Jun 26, 2020 N/A· v4 7.8 HIGH· v3 4.4 MEDIUM· v2 ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2020-3767 1Adobe 1Coldfusion Jun 17, 2026 Jun 26, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could lead to application-level denial-of-service (dos).
CVE-2020-3794 1Adobe 1Coldfusion Jun 17, 2026 Mar 25, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory.
CVE-2020-3761 1Adobe 1Coldfusion Jun 17, 2026 Mar 25, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. Successful exploitation could lead to arbitrary file read from the coldfusion install directory.
CVE-2019-8256 1Adobe 1Coldfusion Jun 17, 2026 Dec 19, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2019-8074 1Adobe 1Coldfusion Jun 17, 2026 Sep 27, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user.
CVE-2019-8073 1Adobe 1Coldfusion Jun 17, 2026 Sep 27, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the cont...Show more ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user.Show less
CVE-2019-8072 1Adobe 1Coldfusion Jun 17, 2026 Sep 27, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.

Previous 1...678...13 Next