Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

345 results · page 6 of 7

Jan 8, 2013Adobe ColdFusion Authentication Bypass VulnerabilityCVE-2013-0625 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
Product
ColdFusion
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adobe.com adobe.com
Dec 12, 2012Adobe ColdFusion 9.0 through 9.0.2, and 10, allows local users to bypass intended shared-hosting sandbox permissions via unspecified vectors.CVE-2012-5675 · Websites & servers · Adobe · reported by AdobeMedium 4.4
Adobe ColdFusion 9.0 through 9.0.2, and 10, allows local users to bypass intended shared-hosting sandbox permissions via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com adobe.com
Nov 20, 2012Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of servicCVE-2012-5674 · Websites & servers · Adobe · reported by AdobeHigh 7.1
Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org adobe.com
Sep 12, 2012Unspecified vulnerability in Adobe ColdFusion 10 and earlier allows attackers to cause a denial of service via unknown vectors.CVE-2012-2048 · Websites & servers · Adobe · reported by AdobeMedium 5
Unspecified vulnerability in Adobe ColdFusion 10 and earlier allows attackers to cause a denial of service via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 13, 2012CRLF injection vulnerability in the Component Browser in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary HTTP headers and conductCVE-2012-2041 · Websites & servers · Adobe · reported by AdobeMedium 4.3
CRLF injection vulnerability in the Component Browser in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com adobe.com
Mar 13, 2012Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, whiCVE-2012-0770 · Websites & servers · Adobe · reported by AdobeMedium 5
Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com osvdb.org
Dec 14, 2011Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary CVE-2011-4368 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com securitytracker.com
Dec 14, 2011Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involvCVE-2011-2463 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the cfform tag.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com securitytracker.com
Jun 16, 2011Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allows remote attackers to cause a denial of service via unknown vectors.CVE-2011-2091 · Websites & servers · Adobe · reported by AdobeMedium 5
Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allows remote attackers to cause a denial of service via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org adobe.com
Jun 16, 2011Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allows remote attackers to hijack the authentication of unspecifiCVE-2011-0629 · Websites & servers · Adobe · reported by AdobeMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com exchange.xforce.ibmcloud.com
Feb 10, 2011Session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to hijack web sessions via unspecified vectors.CVE-2011-0584 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to hijack web sessions via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Feb 10, 2011Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via the cfform tagCVE-2011-0583 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via the cfform tag.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Feb 10, 2011Unspecified vulnerability in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allows attackers to obtain sensitive information via unknown vectorCVE-2011-0582 · Websites & servers · Adobe · reported by AdobeMedium 5
Unspecified vulnerability in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allows attackers to obtain sensitive information via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Feb 10, 2011Multiple CRLF injection vulnerabilities in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response CVE-2011-0581 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Multiple CRLF injection vulnerabilities in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified tags.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Feb 10, 2011Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrarCVE-2011-0580 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Feb 1, 2011Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installationCVE-2011-0737 · Websites & servers · adobe · reported by MITREMedium 5.3
Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
Product
coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Feb 1, 2011Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive informationCVE-2011-0736 · Websites & servers · Adobe · reported by MITREMedium 5.3
Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Feb 1, 2011Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involvCVE-2011-0735 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com kb2.adobe.com
Feb 1, 2011Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameteCVE-2011-0734 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com kb2.adobe.com
Feb 1, 2011Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-AgentCVE-2011-0733 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an id=- query to a .cfm file.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com kb2.adobe.com
Aug 11, 2010Adobe ColdFusion Directory Traversal VulnerabilityCVE-2010-2861 · Websites & servers · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
Product
ColdFusion
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityreason.com securityreason.com
May 13, 2010Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors.CVE-2010-1294 · Websites & servers · Adobe · reported by AdobeLow 2.1
Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
May 13, 2010Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web scripCVE-2010-1293 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
May 13, 2010Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web scriptCVE-2009-3467 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Feb 3, 2010The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackCVE-2010-0185 · Websites & servers · Adobe · reported by AdobeMedium 5
The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb2.adobe.com osvdb.org
Aug 18, 2009Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.CVE-2009-1878 · Websites & servers · Adobe · reported by MITREMedium 5.8
Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org adobe.com
Aug 18, 2009Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified veCVE-2009-1877 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1875.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org adobe.com
Aug 18, 2009Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vuCVE-2009-1876 · Websites & servers · Adobe · reported by MITREMedium 5
Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org adobe.com
Aug 18, 2009Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspCVE-2009-1875 · Websites & servers · Adobe · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1877.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org adobe.com
Aug 18, 2009Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTCVE-2009-1872 · Websites & servers · Adobe · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Apr 2, 2009The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to doCVE-2008-6580 · Other software · Funscripts · reported by MITREMedium 5
The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request to (1) makered.mdb and (2) makered97.mdb.
Product
RED Reservations
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exploit-db.com
Nov 10, 2008Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive informCVE-2008-4831 · Websites & servers · Adobe · reported by MITREHigh 7.2
Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive information or possibly gain privileges, via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 9, 2008Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via FlexCVE-2008-1656 · Websites & servers · Adobe · reported by MITREHigh 7.5
Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Mar 11, 2008Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified veCVE-2008-0644 · Websites & servers · Adobe · reported by MITREMedium 5
Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding function.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Mar 11, 2008Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecifieCVE-2008-0643 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Mar 11, 2008The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers toCVE-2008-1203 · Websites & servers · Adobe · reported by MITREHigh 7.5
The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Nov 15, 2007Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion applicatiCVE-2007-5905 · Websites & servers · Adobe · reported by MITREMedium 6.8
Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 21, 2007Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote atCVE-2007-3339 · Other software · Fusetalk · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the (1) FTVAR_LINKP and (2) FTVAR_URLP parameters to (a) forum/include/error/autherror.cfm, and the (3) FTVAR_SCRIPTRUN parameter to (b) forum/include/common/comfinish.cfm and (c) blog/include/common/comfinish.cfm.
Product
Fusetalk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Apr 11, 2007Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code orCVE-2007-1874 · Websites & servers · Adobe · reported by MITREHigh 7.2
Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.idefense.com osvdb.org
Mar 16, 2007Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote CVE-2007-1278 · Websites & servers · Adobe · reported by MITREMedium 4.3
Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Feb 13, 2007Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary webCVE-2006-5860 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Feb 13, 2007Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to injectCVE-2006-5859 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Feb 7, 2007Cross-site scripting (XSS) vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP hCVE-2007-0817 · Websites & servers · Adobe · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP header, which is not sanitized before being displayed in an error page.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 31, 2006Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source coCVE-2006-5858 · Websites & servers · Adobe · reported by MITREMedium 5
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.idefense.com osvdb.org
Dec 12, 2006Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC filCVE-2006-6482 · Websites & servers · Adobe · reported by MITREMedium 5
Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can reveal the server's internal IP address in an HREF tag.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Dec 12, 2006Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackerCVE-2006-6483 · Websites & servers · Adobe · reported by MITRELow 2.6
Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script" in a tag.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Oct 10, 2006Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to CVE-2006-3978 · Websites & servers · Adobe · reported by MITREMedium 4.6
Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary code via unknown attack vectors.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Sep 13, 2006Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified CVE-2006-4726 · Websites & servers · Adobe · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Sep 13, 2006Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service (infinCVE-2006-4724 · Websites & servers · Adobe · reported by MITREMedium 5
Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors involving a crafted command.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Sep 13, 2006Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templates that are locateCVE-2006-4725 · Websites & servers · Adobe · reported by MITREMedium 4.6
Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templates that are located outside of the sandbox.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.