Adobe Coldfusion vulnerabilities

CVE-2022-35710 [CRITICAL] CWE-121 CVE-2022-35710: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent

CVE-2022-38418 [CRITICAL] CWE-22 CVE-2022-38418: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CVE-2022-35690 [CRITICAL] CWE-121 CVE-2022-35690: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent

CVE-2022-35712 [CRITICAL] CWE-122 CVE-2022-35712: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap- Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent

CVE-2022-35711 [CRITICAL] CWE-122 CVE-2022-35711: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap- Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent

CVE-2022-42341 [HIGH] CWE-611 CVE-2022-42341: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

CVE-2022-38424 [HIGH] CWE-22 CVE-2022-38424: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. Exploitation of this issue does not require user interaction, but does require administrator privileges.

CVE-2022-38421 [HIGH] CWE-22 CVE-2022-38421: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but does require admi

CVE-2022-38419 [HIGH] CWE-611 CVE-2022-38419: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

CVE-2022-38420 [HIGH] CWE-798 CVE-2022-38420: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use o Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in application denial-of-service by gaining access to start/stop arbitrary services. Exploitation of this issue does not require user interaction.

CVE-2022-42340 [HIGH] CWE-20 CVE-2022-42340: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

CVE-2022-38422 [HIGH] CWE-22 CVE-2022-38422: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction.

CVE-2022-38423 [MEDIUM] CWE-22 CVE-2022-38423: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Impr Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction, but does require administrator privileges.

CVE-2022-28818 [MEDIUM] CWE-79 CVE-2022-28818: ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scri ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

CVE-2020-10145 [HIGH] CWE-284 CVE-2020-10145: The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default instal The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.

CVE-2021-21087 [MEDIUM] CWE-79 CVE-2021-21087: Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.32 Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of

CVE-2020-9672 [HIGH] CWE-426 CVE-2020-9672: Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versi Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

CVE-2020-9673 [HIGH] CWE-426 CVE-2020-9673: Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versi Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

CVE-2020-3768 [HIGH] CWE-426 CVE-2020-3768: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerabi ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

CVE-2020-3767 [MEDIUM] CWE-20 CVE-2020-3767: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulne ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could lead to application-level denial-of-service (dos).