CVE-2025-30294

MEDIUM Year: 2025
CVSS v3 Score
6.8
Medium
Weakness Type
CWE-20
View all →

Vulnerability Description

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized read access. Exploitation of this issue does not require user interaction and scope is changed.

Related Vulnerabilities

CVE-2015-1928

MEDIUM
CVSS:6.8(Medium)

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.x before 6.0.0 IF4; Rational Quality Manager (RQ...

CWE-202015

CVE-2015-8373

MEDIUM
CVSS:6.8(Medium)

The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea, when certain debugging settings are used, allow remote attackers to cause a denial of service (daemon crash) via a malformed packet...

CWE-202015

CVE-2016-0774

MEDIUM
CVSS:6.8(Medium)

The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-2...

CWE-202016

CVE-2016-1563

MEDIUM
CVSS:6.8(Medium)

NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CWE-202016

CVE-2016-2088

MEDIUM
CVSS:6.8(Medium)

resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed p...

CWE-202016

CVE-2016-2270

MEDIUM
CVSS:6.8(Medium)

Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.

CWE-202016