CO
App Server
ColdFusion
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
17
On KEV
10.0
Max CVSS
30
New 30D
Severity mix
Critical 81High 99Medium 49Low 5
Watch
Add ColdFusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-1388 | – | Apr 10 | Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain… Affected: 9.0; 9.0.1; 9.0.2; 10.0; 10.0; 10.0; +1 more |
| CVE-2013-1387 | – | Apr 10 | Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via… Affected: 9.0; 9.0.1; 9.0.2; 10.0; 10.0; 10.0; +1 more |
| CVE-2012-5675 | – | Dec 12 | Adobe ColdFusion 9.0 through 9.0.2, and 10, allows local users to bypass intended shared-hosting sandbox permissions via unspecified vectors Affected: 9.0; 9.0.1; 9.0.2; 10.0 |
| CVE-2012-5674 | – | Nov 20 | Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown… Affected: 10.0; 10.0; 10.0; 10.0 |
| CVE-2012-2048 | – | Sep 12 | Unspecified vulnerability in Adobe ColdFusion 10 and earlier allows attackers to cause a denial of service via unknown vectors Affected: through 10.0; 8.0; 8.0.1; 9.0; 9.0.1; 9.0.2 |
| CVE-2012-2041 | – | Jun 13 | CRLF injection vulnerability in the Component Browser in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response… Affected: 8.0; 8.0.1; 9.0 |
| CVE-2012-0770 | – | Mar 13 | Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote… Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-4368 | – | Dec 14 | Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML… Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-2463 | – | Dec 14 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the cfform tag Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-2091 | – | Jun 16 | Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allows remote attackers to cause a denial of service via unknown vectors Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-0629 | – | Jun 16 | Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allows remote attackers to hijack the authentication of unspecified victims via… Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-0582 | – | Feb 10 | Unspecified vulnerability in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allows attackers to obtain sensitive information via unknown vectors Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-0583 | – | Feb 10 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via the cfform tag Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-0584 | – | Feb 10 | Session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to hijack web sessions via unspecified vectors Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-0581 | – | Feb 10 | Multiple CRLF injection vulnerabilities in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks… Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-0580 | – | Feb 10 | Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary web script or… Affected: 8.0; 8.0.1; 9.0; 9.0.1 |
| CVE-2011-0734 | – | Feb 1 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a… Affected: through 9.0.1; 4.5; 5.0; 6.0; 6.1; 7.0; +7 more |
| CVE-2011-0733 | – | Feb 1 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an… Affected: All versions, or not specified |
| CVE-2011-0735 | – | Feb 1 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script." Affected: through 9.0.1; 4.5; 5.0; 6.0; 6.1; 7.0; +7 more |
| CVE-2010-1294 | – | May 13 | Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors Affected: through 9.0; 4.5; 5.0; 6.0; 6.1; 7.0; +5 more |
| CVE-2010-1293 | – | May 13 | Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 9.0; 4.5; 5.0; 6.0; 6.1; 7.0; +5 more |
| CVE-2009-3467 | – | May 13 | Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 9.0; 4.5; 5.0; 6.0; 6.1; 7.0; +5 more |
| CVE-2010-0185 | – | Feb 3 | The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain… Affected: 9.0 |
| CVE-2009-1878 | – | Aug 18 | Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors Affected: through 8.0.1; 6.0; 6.0; 6.0; 6.0; 6.0; +15 more |
| CVE-2009-1877 | – | Aug 18 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: through 8.0.1; 6.0; 6.0; 6.0; 6.0; 6.0; +15 more |
| CVE-2009-1876 | – | Aug 18 | Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability." Affected: through 8.0.1; 6.0; 6.0; 6.0; 6.0; 6.0; +14 more |
| CVE-2009-1875 | – | Aug 18 | Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a… Affected: through 8.0.1; 6.0; 6.0; 6.0; 6.0; 6.0; +15 more |
| CVE-2009-1872 | – | Aug 18 | Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the… Affected: through 8.0.1; 6.0; 6.0; 6.0; 6.0; 6.0; +15 more |
| CVE-2008-4831 | – | Nov 10 | Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive information or possibly… Affected: 7.2; 8.0; 8.0.1 |
| CVE-2008-1656 | – | Apr 9 | Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a… Affected: 8.0; 8.1 |
| CVE-2008-1203 | – | Mar 12 | The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute… Affected: 7.0; 8.0 |
| CVE-2008-0644 | – | Mar 12 | Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to… Affected: 7.0; 7.0.1; 7.0.2; 8.0 |
| CVE-2008-0643 | – | Mar 12 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 7.0; 7.0.1; 7.0.2; 8.0 |
| CVE-2007-5905 | – | Nov 15 | Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1)… Affected: 7.0; 8.0 |
| CVE-2007-1874 | – | Apr 11 | Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive… Affected: 7.0; 7.0 |
| CVE-2007-1278 | – | Mar 16 | Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause… Affected: 6.1; 7.0 |
| CVE-2006-5860 | – | Feb 14 | Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via… Affected: 6.1; 7.0 |
| CVE-2006-5859 | – | Feb 14 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and… Affected: 7.0; 7.0.1 |
| CVE-2007-0817 | – | Feb 7 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP header, which is not… Affected: 6.1; 7.0.1; 7.0.2 |
| CVE-2006-5858 | – | Dec 31 | Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double… Affected: 7.0 through 7.0.2 |
| CVE-2006-6482 | – | Dec 12 | Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays… Affected: 7.0 |
| CVE-2006-6483 | – | Dec 12 | Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject… Affected: 7.0; 7.0.1 |
| CVE-2006-3978 | – | Oct 10 | Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary… Affected: 7.0; 7.0.1; 7.0.2 |
| CVE-2006-4724 | – | Sep 14 | Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service (infinite loop) via… Affected: 7.0; 7.0.1 |
| CVE-2006-4725 | – | Sep 14 | Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templates that are located outside of the… Affected: 7.0; 7.0.1 |
| CVE-2006-4726 | – | Sep 14 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a… Affected: 6.1; 7.0; 7.0.1 |