Adobe Coldfusion vulnerabilities
207 known vulnerabilities affecting adobe/coldfusion.
Total CVEs
207
CISA KEV
16
actively exploited
Public exploits
21
Exploited in wild
17
Severity breakdown
CRITICAL55HIGH59MEDIUM85LOW8
Vulnerabilities
Page 7 of 11
CVE-2018-15963MEDIUMCVSS 5.3v11.0v2016+2 more2018-09-25
CVE-2018-15963 [MEDIUM] CVE-2018-15963: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation.
cvelistv5nvd
CVE-2018-15962MEDIUMCVSS 5.3v11.0v2016+2 more2018-09-25
CVE-2018-15962 [MEDIUM] CWE-200 CVE-2018-15962: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability. Successful exploitation could lead to information disclosure.
cvelistv5nvd
CVE-2018-4939CRITICALCVSS 9.8KEVv11.0v20162018-05-19
CVE-2018-4939 [CRITICAL] CWE-502 CVE-2018-4939: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
nvd
CVE-2018-4942HIGHCVSS 7.5v11.0v20162018-05-19
CVE-2018-4942 [HIGH] CWE-611 CVE-2018-4942: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure.
nvd
CVE-2018-4938HIGHCVSS 7.8v11.0v20162018-05-19
CVE-2018-4938 [HIGH] CWE-427 CVE-2018-4938: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability. Successful exploitation could lead to local privilege escalation.
nvd
CVE-2018-4940MEDIUMCVSS 6.1v11.0v20162018-05-19
CVE-2018-4940 [MEDIUM] CWE-79 CVE-2018-4940: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.
nvd
CVE-2018-4941MEDIUMCVSS 6.1v11.0v20162018-05-19
CVE-2018-4941 [MEDIUM] CWE-79 CVE-2018-4941: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.
nvd
CVE-2017-11283CRITICALCVSS 9.8v11.0v20162017-12-01
CVE-2017-11283 [CRITICAL] CWE-502 CVE-2017-11283: Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earl
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
nvd
CVE-2017-11284CRITICALCVSS 9.8v11.0v20162017-12-01
CVE-2017-11284 [CRITICAL] CWE-502 CVE-2017-11284: Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earl
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
nvd
CVE-2017-11286HIGHCVSS 7.5v11.0v20162017-12-01
CVE-2017-11286 [HIGH] CWE-611 CVE-2017-11286: Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and
Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
nvd
CVE-2017-11285MEDIUMCVSS 6.1v11.0v20162017-12-01
CVE-2017-11285 [MEDIUM] CWE-79 CVE-2017-11285: Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier v
Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
nvd
CVE-2017-3066CRITICALCVSS 9.8KEVPoCv10.0v11.0+1 more2017-04-27
CVE-2017-3066 [CRITICAL] CWE-502 CVE-2017-3066: Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Updat
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
nvd
CVE-2017-3008MEDIUMCVSS 6.1v10.0v11.0+1 more2017-04-27
CVE-2017-3008 [MEDIUM] CWE-79 CVE-2017-3008: Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Updat
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.
nvd
CVE-2016-4264HIGHCVSS 8.6PoC≤ 10.0≤ 11.02016-09-01
CVE-2016-4264 [HIGH] CWE-611 CVE-2016-4264: The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
nvd
CVE-2016-4159MEDIUMCVSS 6.1v10.0v11.0+1 more2016-06-16
CVE-2016-4159 [MEDIUM] CWE-79 CVE-2016-4159: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2016-1114CRITICALCVSS 9.8v10.0v11.0+1 more2016-05-11
CVE-2016-1114 [CRITICAL] CWE-502 CVE-2016-1114: Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote att
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
nvd
CVE-2016-1113MEDIUMCVSS 6.1v10.0v11.0+1 more2016-05-11
CVE-2016-1113 [MEDIUM] CWE-79 CVE-2016-1113: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2016-1115MEDIUMCVSS 5.9v10.0v11.0+1 more2016-05-11
CVE-2016-1115 [MEDIUM] CWE-20 CVE-2016-1115: Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildca
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
nvd
CVE-2015-8052MEDIUMCVSS 4.3≤ 10.0≤ 11.02015-11-18
CVE-2015-8052 [MEDIUM] CWE-79 CVE-2015-8052: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Updat
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.
nvd
CVE-2015-5255MEDIUMCVSS 4.3≤ 10.0≤ 11.02015-11-18
CVE-2015-5255 [MEDIUM] CWE-20 CVE-2015-5255: Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data S
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a
nvd