Advisories · Technology

Adobe ColdFusion.

Every CVE that names Adobe ColdFusion among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-44350 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Deserialization of Untrusted Data (CWE-502)
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 17 Nov 2023
CVE-2023-38204 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 14 Sept 2023
CVE-2023-38205 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
- Adobe ColdFusion
- Broken access control
Not analysed yet 14 Sept 2023
CVE-2023-38206 CVE record

CVSS 5.3 Medium

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion
- Broken access control
Not analysed yet 14 Sept 2023
CVE-2021-40699 CVE record

CVSS 7.4 High

ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation
- Adobe ColdFusion
- Broken access control
Not analysed yet 7 Sept 2023
CVE-2021-40698 CVE record

CVSS 7.4 High

ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass
- Adobe ColdFusion
- CWE-242
Not analysed yet 7 Sept 2023
CVE-2023-38203 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 20 Jul 2023
CVE-2023-29300 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 12 Jul 2023
CVE-2023-29301 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass
- Adobe ColdFusion
- Authentication bypass
Not analysed yet 12 Jul 2023
CVE-2023-29298 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV

Adobe ColdFusion Improper Access Control Security feature bypass
- Adobe ColdFusion
- Broken access control
Not analysed yet 12 Jul 2023
CVE-2023-26361 CVE record

CVSS 4.9 Medium

Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability
- Adobe ColdFusion
- Path traversal
Not analysed yet 23 Mar 2023
CVE-2023-26360 CVE record

CVSS 8.6 HighCritical · KEV, CVSS 7+ and EPSSKEV

Adobe ColdFusion Improper Access Control Arbitrary code execution
- Adobe ColdFusion
- Broken access control
Not analysed yet 23 Mar 2023
CVE-2023-26359 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 23 Mar 2023
CVE-2022-42341 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 14 Oct 2022
CVE-2022-38424 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write
- Adobe ColdFusion
- Path traversal
Not analysed yet 14 Oct 2022
CVE-2022-42340 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Improper Input Validation Arbitrary file system read
- Adobe ColdFusion
- CWE-20
Not analysed yet 14 Oct 2022
CVE-2022-38423 CVE record

CVSS 4.9 Medium

Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability
- Adobe ColdFusion
- Path traversal
Not analysed yet 14 Oct 2022
CVE-2022-38422 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability
- Adobe ColdFusion
- Path traversal
Not analysed yet 14 Oct 2022
CVE-2022-38421 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability
- Adobe ColdFusion
- Path traversal
Not analysed yet 14 Oct 2022
CVE-2022-38419 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 14 Oct 2022
CVE-2022-35711 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability
- Adobe ColdFusion
- Memory corruption
Not analysed yet 14 Oct 2022
CVE-2022-38420 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service
- Adobe ColdFusion
- Hard-coded credentials
Not analysed yet 14 Oct 2022
CVE-2022-35690 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability
- Adobe ColdFusion
- Memory corruption
Not analysed yet 14 Oct 2022
CVE-2022-35712 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability
- Adobe ColdFusion
- Memory corruption
Not analysed yet 14 Oct 2022
CVE-2022-35710 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability
- Adobe ColdFusion
- Memory corruption
Not analysed yet 14 Oct 2022
CVE-2022-38418 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability
- Adobe ColdFusion
- Path traversal
Not analysed yet 14 Oct 2022
CVE-2022-28818 CVE record

CVSS 6.1 Medium

ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 12 May 2022
CVE-2020-10145 CVE record

CVSS 7.8 High

Improper access control in Adobe ColdFusion
- Adobe ColdFusion
- Broken access control
Not analysed yet 27 May 2021
CVE-2021-21087 CVE record

CVSS 5.4 Medium

ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 15 Apr 2021
CVE-2020-3796 CVE record

Adobe ColdFusion: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control…
- Adobe ColdFusion
Not analysed yet 26 Jun 2020
CVE-2020-3768 CVE record

Adobe ColdFusion: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order…
- Adobe ColdFusion
Not analysed yet 26 Jun 2020
CVE-2020-3767 CVE record

Adobe ColdFusion: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input…
- Adobe ColdFusion
Not analysed yet 26 Jun 2020
CVE-2020-3794 CVE record

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability.
- Adobe ColdFusion
Not analysed yet 25 Mar 2020
CVE-2020-3761 CVE record

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability.
- Adobe ColdFusion
Not analysed yet 25 Mar 2020
CVE-2019-8256 CVE record

Adobe ColdFusion: ColdFusion versions Update 6 and earlier have an insecure inherited permissions of…
- Adobe ColdFusion
Not analysed yet 19 Dec 2019
CVE-2019-7840 CVE record

Adobe ColdFusion: ColdFusion versions Update 3 and earlier, Update 10 and earlier…
- Adobe ColdFusion
Not analysed yet 12 Jun 2019
CVE-2019-7839 CVE record

Adobe ColdFusion: ColdFusion versions Update 3 and earlier, Update 10 and earlier…
- Adobe ColdFusion
Not analysed yet 12 Jun 2019
CVE-2019-7838 CVE record

Adobe ColdFusion: ColdFusion versions Update 3 and earlier, Update 10 and earlier…
- Adobe ColdFusion
Not analysed yet 12 Jun 2019
CVE-2019-7092 CVE record

Adobe ColdFusion: ColdFusion versions Update 1 and earlier, Update 7 and earlier…
- Adobe ColdFusion
Not analysed yet 24 May 2019
CVE-2019-7091 CVE record

Adobe ColdFusion: ColdFusion versions Update 1 and earlier, Update 7 and earlier…
- Adobe ColdFusion
Not analysed yet 24 May 2019
CVE-2019-7816 CVE record

Adobe ColdFusion: ColdFusion versions Update 2 and earlier, Update 9 and earlier…
- Adobe ColdFusion
Not analysed yet 24 May 2019
CVE-2018-15965 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Deserialization of untrusted data in Adobe ColdFusion
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 25 Sept 2018
CVE-2018-15964 CVE record

CVSS 7.5 High

Information disclosure in Adobe ColdFusion
- Adobe ColdFusion
- Information disclosure
Not analysed yet 25 Sept 2018
CVE-2018-15963 CVE record

CVSS 5.3 Medium

Adobe ColdFusion: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier…
- Adobe ColdFusion
Not analysed yet 25 Sept 2018
CVE-2018-15962 CVE record

CVSS 5.3 Medium

Information disclosure in Adobe ColdFusion
- Adobe ColdFusion
- Information disclosure
Not analysed yet 25 Sept 2018
CVE-2018-15961 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Unrestricted file upload in Adobe ColdFusion
- Adobe ColdFusion
- Unrestricted file upload
Not analysed yet 25 Sept 2018
CVE-2018-15960 CVE record

Adobe ColdFusion: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier…
- Adobe ColdFusion
Not analysed yet 25 Sept 2018
CVE-2018-15959 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Deserialization of untrusted data in Adobe ColdFusion
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 25 Sept 2018
CVE-2018-15958 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Deserialization of untrusted data in Adobe ColdFusion
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 25 Sept 2018
CVE-2018-15957 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Deserialization of untrusted data in Adobe ColdFusion
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 25 Sept 2018