Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2726▼ 504 respecto a la semana anterior
Críticas / altas1294▼ 196 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)229▼ 273 respecto a la semana anterior
311 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (7.5) | 10% | 💥 Exploit | Adobe Coldfusion | 17/11/2023 | 17/6/2026 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue… | |
| Modificada | Media (5.3) | 0.70% | — | Adobe Coldfusion | 14/9/2023 | 17/6/2026 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints resulting in a… | |
| Analizada | Alta (7.5) | 100% | ⚠ Explotación activa💥 Exploit | Adobe Coldfusion | 14/9/2023 | 17/6/2026 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this… | |
| Modificada | Crítica (9.8) | 67% | — | Adobe Coldfusion | 14/9/2023 | 17/6/2026 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. | |
| Modificada | Alta (7.4) | 0.51% | — | Adobe Coldfusion | 7/9/2023 | 17/6/2026 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment. | |
| Modificada | Alta (7.4) | 0.55% | — | Adobe Coldfusion | 7/9/2023 | 17/6/2026 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment. | |
| Analizada | Crítica (9.8) | 97% | ⚠ Explotación activa💥 Exploit | Adobe Coldfusion | 20/7/2023 | 17/6/2026 | Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. | |
| Modificada | Alta (7.5) | 35% | — | Adobe Coldfusion | 12/7/2023 | 17/6/2026 | Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the confidentiality… | |
| Analizada | Crítica (9.8) | 100% | ⚠ Explotación activa💥 Exploit | Adobe Coldfusion | 12/7/2023 | 17/6/2026 | Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. | |
| Analizada | Alta (7.5) | 100% | ⚠ Explotación activa💥 Exploit | Adobe Coldfusion | 12/7/2023 | 17/6/2026 | Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation… | |
| Modificada | Media (4.9) | 59% | — | Adobe Coldfusion | 23/3/2023 | 17/6/2026 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does… | |
| Analizada | Crítica (9.8) | 97% | ⚠ Explotación activa💥 Exploit | Adobe Coldfusion | 23/3/2023 | 17/6/2026 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. | |
| Analizada | Crítica (9.8) | 17% | ⚠ Explotación activa | Adobe Coldfusion | 23/3/2023 | 17/6/2026 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. | |
| Modificada | Alta (7.5) | 36% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction. | |
| Modificada | Alta (7.5) | 34% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction. | |
| Modificada | Alta (7.2) | 45% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. Exploitation of this issue does not require user interaction, but does require… | |
| Modificada | Media (4.9) | 45% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction, but does require… | |
| Modificada | Alta (7.5) | 44% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction. | |
| Modificada | Alta (7.2) | 79% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user… | |
| Modificada | Alta (7.5) | 44% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in application denial-of-service by gaining access to start/stop arbitrary services. Exploitation of this issue does not require user interaction. | |
| Modificada | Alta (7.5) | 53% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction. | |
| Modificada | Crítica (9.8) | 80% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user… | |
| Modificada | Crítica (9.8) | 37% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a… | |
| Modificada | Crítica (9.8) | 73% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a… | |
| Modificada | Crítica (9.8) | 43% | — | Adobe Coldfusion | 14/10/2022 | 17/6/2026 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a… |