Vulnerabilities > Adobe > Coldfusion > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-05-11 CVE-2016-1114 Deserialization of Untrusted Data vulnerability in Adobe Coldfusion 10.0/11.0/2016
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
network
low complexity
adobe CWE-502
critical
9.8
2013-01-17 CVE-2013-0632 Incorrect Default Permissions vulnerability in Adobe Coldfusion
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
network
low complexity
adobe CWE-276
critical
9.8
2013-01-09 CVE-2013-0625 Improper Authentication vulnerability in Adobe Coldfusion 9.0/9.0.1/9.0.2
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
network
low complexity
adobe CWE-287
critical
9.8
2010-08-11 CVE-2010-2861 Path Traversal vulnerability in Adobe Coldfusion
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
network
low complexity
adobe CWE-22
critical
9.8