Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
coldfusion vulnerabilities and exploits
(subscribe to this query)
5.9
CVSSv3
CVE-2016-1115
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle malicious users to spoof servers via a crafted certificate.
Adobe Coldfusion 10.0
Adobe Coldfusion 11.0
Adobe Coldfusion 2016
6.1
CVSSv3
CVE-2016-4159
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.
Adobe Coldfusion 10.0
Adobe Coldfusion 11.0
Adobe Coldfusion 2016
NA
CVE-2002-0576
ColdFusion 5.0 and previous versions on Windows systems allows remote malicious users to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message.
Allaire Coldfusion Server 5.0
Allaire Coldfusion Server 4.0
Allaire Coldfusion Server 4.5
NA
CVE-2000-0189
ColdFusion Server 4.x allows remote malicious users to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files.
Allaire Coldfusion Server 4.0
Allaire Coldfusion Server 4.0.1
Allaire Coldfusion Server 4.5
NA
CVE-2002-1992
Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote malicious users to cause a denial of service in IIS via (1) a long template file name or (2) a long HTTP header.
Macromedia Coldfusion
Macromedia Coldfusion Professional
NA
CVE-2013-5328
Adobe ColdFusion 10 before Update 12 allows remote malicious users to read arbitrary files via unspecified vectors.
Adobe Coldfusion 10.0
Adobe Coldfusion
7.5
CVSSv3
CVE-2020-3761
ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. Successful exploitation could lead to arbitrary file read from the coldfusion install directory.
Adobe Coldfusion 2016
Adobe Coldfusion 2018
7.8
CVSSv3
CVE-2020-9672
Adobe ColdFusion 2016 update 15 and previous versions versions, and ColdFusion 2018 update 9 and previous versions versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.
Adobe Coldfusion 2016
Adobe Coldfusion 2018
NA
CVE-2008-1656
Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote malicious users to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725.
Adobe Coldfusion 8.0
Adobe Coldfusion 8.1
NA
CVE-2006-3979
The AdminAPI of ColdFusion MX 7 allows malicious users to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion Administrator.
Macromedia Coldfusion 7.0
Macromedia Coldfusion 7.02
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
authentication bypass
CVE-2024-30051
remote
CVE-2024-27954
CVE-2023-51483
CVE-2023-47782
SSRF
CVE-2024-24715
CVE-2023-52424
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
5
6
7
8
9
10
NEXT »