• ColdFusion allows an unauthenticated user to connect to any LDAP server. An attacker can exploit it to achieve remote code execution.

• Upgrade to the latest version of ColdFusion.

• • APSB18-33
  • A Journey From JNDI/LDAP Manipulation To RCE

• 

• CVE-2018-15957

• CWE-502

• Code Execution

• WordPress Plugin Custom Content Type Manager Remote Code Execution (0.9.8.5)
• CakePHP 1.3.5 / 1.2.8 unserialize() vulnerability
• Gallery 3.0.4 remote code execution
• HTTP.sys remote code execution vulnerability
• WordPress Plugin Gantry 4 Framework Remote Command Execution (4.1.3)