Adobe ColdFusion Updated

Adobe have released updated version of ColdFusion web application development platform. This fix resolves two critical categorized (CVE-2021-40698, CVE-2021-40699) vulnerabilities that may lead to a security feature bypass.

Affected versions:
- ColdFusion (2021 release): version 1 and earlier versions
- ColdFusion (2018 release): update 11 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Updated

Adobe have released updated version of ColdFusion web application development platform. This fix resolves a moderate categorized (CVE-2021-21087) vulnerability that could lead to arbitrary code execution.

Affected versions:
- ColdFusion (2021 release): version 2021.0.0.323925
- ColdFusion (2018 release): update 10 and earlier versions
- ColdFusion (2016 release): update 16 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Vulnerability

There has been found a privilege escalation vulnerability in Adobe ColdFusion. The cause of vulnerability is that ColdFusion installer fails to properly set ACLs (access-control lists) on the default installation directory such as C:\ColdFusion2021. By exploiting the vulnerability it may be possible to run arbitrary code with SYSTEM privileges in Windows system with vulnerable ColdFusion version installed.

Solution is to use the ColdFusion Server Auto-Lockdown installer. More information available here.

Adobe ColdFusion Updated

Adobe have released updated version of ColdFusion web application development platform. This fix resolves two important categorized (CVE-2020-9672, CVE-2020-9673) vulnerabilities that could lead to privilege escalation.

Affected versions:
- ColdFusion (2018 release): update 9 and earlier versions
- ColdFusion (2016 release): update 15 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Updated

Adobe have released updated version of ColdFusion web application development platform. This fix resolves three important categorized (CVE-2020-3767, CVE-2020-3768, CVE-2020-3796) vulnerabilities.

Affected versions:
- ColdFusion (2018 release): update 8 and earlier versions
- ColdFusion (2016 release): update 14 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Updated

Adobe have released updated version of ColdFusion web application development platform. This fix resolves two critical categorized (CVE-2020-3761, CVE-2020-3794) vulnerabilities which may allow execution of arbitrary code.

Affected versions:
- ColdFusion (2018 release): update 7 and earlier versions
- ColdFusion (2016 release): update 13 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Fix Available

Adobe have released updated version of ColdFusion web application development platform. This fix resolves one important categorized (CVE-2019-8256) vulnerability which may allow privilege escalation.

Affected versions:
- ColdFusion (2018 release): update 6 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Fixed

Adobe have released updated versions of ColdFusion web application development platform. These fixes resolve two critical (CVE-2019-8073, CVE-2019-8074) and one important (CVE-2019-8072) vulnerabilities of which one may allow an attacker to execute arbitrary code in the affected system.

Affected versions:
- ColdFusion (2018 release): update 4 and earlier versions
- ColdFusion (2016 release): update 11 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Fixed

Adobe have released updated versions of ColdFusion web application development platform. These fixes resolve three critical vulnerabilities (CVE-2019-7838, CVE-2019-7839, CVE-2019-7840) that may allow an attacker to execute arbitrary code in the affected system.

Affected versions:
- ColdFusion (2018 release): update 3 and earlier versions
- ColdFusion (2016 release): update 10 and earlier versions
- ColdFusion 11: update 18 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Fix Available

Adobe have released updated versions of ColdFusion web application development platform. These fixes resolve security vulnerabilities of which one critical (CVE-2019-7091) and one important (CVE-2019-7092). Successful exploitation of the critical vulnerability may allow an attacker to execute arbitrary code in the affected system.

Affected versions:
- ColdFusion (2018 release): update 1 and earlier versions
- ColdFusion (2016 release): update 7 and earlier versions
- ColdFusion 11: update 15 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Fix Available

Adobe have released updated versions of ColdFusion web application development platform. These fixes resolve security vulnerabilities of which some critical. Successful exploitation of these vulnerabilities may allow an attacker to execute arbitrary code in the affected system.

Affected versions:
- ColdFusion (2018 release): July 12 release (2018.0.0.310739)
- ColdFusion (2016 release): update 6 and earlier versions
- ColdFusion 11: update 14 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Fix Available

Adobe have released updated versions of ColdFusion web application development platform. These fixes resolve an important insecure library loading vulnerability (CVE-2018-4938), an important cross-site scripting vulnerability that could lead to code injection (CVE-2018-4940) and an important cross-site scripting vulnerability that could lead to information disclosure (CVE-2018-4941). These updates also include a mitigation for a critical unsafe Java deserialization vulnerability (CVE-2018-4939) and a mitigation for a critical unsafe XML parsing vulnerability (CVE-2018-4942).

Affected versions:
- ColdFusion (2016 release): update 5 and earlier versions
- ColdFusion 11: update 13 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Fix Available

Adobe have released updated versions of ColdFusion web application development platform. These fixes address a critical XML parsing vulnerability (CVE-2017-11286), an important cross-site scripting vulnerability (CVE-2017-11285) that could lead to information disclosure and a mitigation for unsafe Java deserialization that could result in remote code execution (CVE-2017-11283, CVE-2017-11284).

Affected versions:
- ColdFusion (2016 release): update 4 and earlier versions
- ColdFusion 11: update 12 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfix Available

Adobe have released updated versions of ColdFusion web application development platform. These hotfixes resolve an issue associated with parsing crafted XML entities that could lead to information disclosure (CVE-2016-4264).  

Affected versions:
- ColdFusion 11: update 9 and earlier versions
- ColdFusion 10: update 20 and earlier versions


More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfix Available

Adobe have released updated versions of ColdFusion web application development platform. These hotfixes resolve an input validation issue (CVE-2016-1113), a host name verification problem with wild card certificates (CVE-2016-1115) and include an updated version of Apache Commons Collections library to mitigate java deserialization (CVE-2016-1114).  

Affected versions:
- ColdFusion 2016 release and versions 10 & 11


More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfix Available

Adobe have released updated versions of ColdFusion web application development platform. This hotfix resolves two input validation issues (CVE-2015-8052 and CVE-2015-8053) that could be used to conduct reflected cross-site scripting attacks. The fix also includes an updated version of BlazeDS which resolves an important Server-side Request Forgery vulnerability (CVE-2015-5255).  

Affected versions:
- ColdFusion 11 and 10


More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfix Available

Adobe have released updated versions of ColdFusion web application development platform. This hotfix addresses an issue associated with the parsing of crafted XML external entities in BlazeDS that could lead to information disclosure (CVE-2015-3269).

Affected versions:
- ColdFusion 11 and 10


More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfixes Available

Adobe have released updated versions of ColdFusion web application development platform. These hotfixes address a resource consumption issue that could potentially result in a denial of service (CVE-2014-9166).

Affected versions:
- ColdFusion 11 and 10


More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfixes Available

Adobe have released updated versions of ColdFusion web application development platform. These hotfixes address a security permissions issue (CVE-2014-0572) that could be exploited by an unauthenticated local user to bypass IP address access control restrictions applied to the ColdFusion Administrator.  Cross-site scripting and cross-site request forgery vulnerabilities (CVE-2014-0570, CVE-2014-0571) are also addressed in the hotfixes.

Affected versions:
- ColdFusion 11, 10, 9.0.2, 9.0.1 and 9.0 for all platforms


More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfix Update Available

Adobe have released updated version of ColdFusion web application development platform. This hotfix addresses a reflected cross site scripting vulnerability (CVE-2013-5326) that could be exploited by a remote, authenticated user on ColdFusion 10 and earlier when the CFIDE directory is exposed. This hotfix also addresses a vulnerability (CVE-2013-5328) in ColdFusion 10 that could permit unauthorized remote read access.

Affected versions:
- ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and Linux


More information can be read from Adobe's security bulletin.