ColdFusion

Is there a way to capture the value passed in the referrer? I need to capture that and do some searching.

Hello CF Community, I have an application that i am supporting where i need to apply the latest patch to the CF server. Curently we are running 2021 and the servers are patched till update 9.  My team specifiacally does not have experience with applying the latest patch. So my question is can i install the latest update which is 17 right now directly or do i need to do incremental updates?  When checking from CF admin on the servers it can not find the latest update when i click on check for updates. so we will be doing it manually. What files are needed for manual installation of the update.Since we will be doing a manual update can you guys help with any SOPs that might be helpful or list out steps for doing this with info much as possible. Also please let me know if i need to check anything prior. Thanks in advance.

We have released critical security updates for ColdFusion (2023 release) and ColdFusion (2021 release).   Adobe is aware that CVE-2024-53961 has a known proof-of-concept that could cause an arbitrary file system read.   View the security bulletin, APSB24-107, and the tech notes for more information.   Where do I download the updates from Download the updates from the following locations: ColdFusion (2023 release) Updates ColdFusion (2021 release) Updates   For more information, view the following tech notes: ColdFusion (2023 release) Update 12 ColdFusion (2021 release) Update 18   Known issues in the updates When Update 12 of ColdFusion (2023 release) or Update 18 of ColdFusion (2021 release) is installed on JEE deployments, an error message might appear in certain cases upon attempting to view the Settings Summary page in ColdFusion Administrator. If you encounter an issue while applying Update 12 on the ColdFusion (2023 release) cloud images, c

Greetings, I have receiived the following vulnreabilty scan report from our security team for our CF2023 Enterprise on Tomcat.  Installed version : 9.0.93Fixed version     : 9.0.96Plugin Description:The version of Tomcat installed on the remote host is prior to 9.0.96. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.96_security-9 advisory. - Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request     and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92     through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the     issue. (CVE- 2024-523

Hi folks,Tomcat related question, is there any mitigation instruction for https://thehackernews.com/2024/12/apache-tomcat-vulnerability-cve-2024.html?m=1 or an eta for another CF patch ?Have chucked in a feature request > https://tracker.adobe.com/#/view/CF-4225069 anyone else that sees this it would be handy if you could upvote.

Please guide me on the windows server support - Will Windows Server 2012 R2 work with Cold Fusion 2023 or not?

Has anyone had any experience with signing PDFs in ColdFusion using certificates stored on a CAC? I know you can manually import certs to the server, run some java commands to create a keystore, and eventually slap a digital signature on a PDF. What I'd like to do is read the certificate data from the CAC via the browser and use that to populate a digital signature on a PDF using cfpdf - basically recreating the signing of a PDF in Acrobat but within my applications. I'm not sure if this is possible without a 3rd party tool like DbSign or manually moving around PDFs outside the application for signature. Curious to hear of anyone's experience with something like this. Cheers,

Hi everyone, recently our CF server been having some performance issues so I was tasked to install the PMT for monitoring and troubleshooting. After installing and setup the PMT server on a seperate VM. I was able to connect the 2 servers sucsessfully. However, when I check the metrics inside PMT  dashboard, the stats  are all showing 0. One thing I noticed is the metrics show up for a few seconds whenever I reboot the PMT server  but immediately goes to 0 until next time I restart the service. I have tried completely reinstalling Windows and PMT server and the issue is exactly the same. I have tried to look for some setup guide online but seems to be very limited and I cannot find anything that explains the full setup procedure incase I did something wrong.  

Recently we received an error when calling cfinvoke:"Neither the method querytoarray was found in component D:\Websites\ycWeb\trunk\yc\cfc_files\system\resource\company.cfc nor was there any default method with this name present in any of the implementing interface."Here is the call that threw the error (which was made in the company.cfc):<cfinvoke component="#request.path.cfc.querytoarray#" method="querytoarray" xquery="#qry_select_owners#" columnList="#lcase(qry_select_owners.columnList)#" returnvariable="local.arrayResult" />For some reason the initialization disregarded the value in the component attribute.  I don't see how this could have occurred.  This only happened once and then didn't occur again. 

The blog site over at https://coldfusion.adobe.com/blogs/ is not showing any blog posts

I am building a dev machine and recently installed CF2023 in Developer mode (Windows 11 Pro). Everything was working correctly - I could login to CF, added some sites to IIS, was able to access those sites locally and from a test machine. So, I then proceeded to set the alias for the CF_SCRIPTS folder (and added server mapping and MySQL datasources). I am now unable to login to the CF Admin (trying to login locally on the Win 11 Pro machine).  I can see the CF Admin login page, but the ID is prefilled (admin) and nothing happens after entering the correct password and clicking Login. The Coldfusion-out.log file indicates:Error [main] - Unable to install ajax package: java.lang.Exception: Script folder C:\ColdFusion2023\cfusion\wwwroot\[MY-SCRIPT-FOLDER-NAME] not found. Ajax package has been downloaded at C:/ColdFusion2023/bundles/ajax-2023.0.05.330608.zip. If you have created a mapping of cf_scripts folder, you can copy the contents of the downloaded zip into C

Hi, I've been developing for a long time without it working.  But it did work on my old machine.Now I really really need it to work. CF 2023, up to date.Windows 11 is up to date. Debugging Port is set to 5005I even opened this port in Windows 11 to make sure that wasn't the issue. Also, in CF Logs I'm seeing the error below.  I have no idea how to approach it.Maybe I don't need to worry about it. ColdFusion App has been working. Just not the Debugging, at all.So, when I hit certain snags I really need it.Could this be the problem? Thanks In Advance!! ERROR: --------------------------------------------------------------------------------------------Dec 07, 2024 8:14:17 AM org.elasticsearch.client.sniff.Sniffer runSEVERE: error while sniffing nodesjava.io.IOException: An established connection was aborted by the software in your host machineat org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:937)at org.elasticsearch.clie

The SSO Azure Ad team gave us an .xml and .cer files.I uploaded the .xml for creation of the IDP Configuration. For IDP Xml upload, there is no spot for uploading a cert file Where should I upload the .cer file? should I import it to the ColdFusion Key Store or my Java Home Keystore and reference the path in the "Signing Keystore Path"

We are pleased to announce that we have released general updates to ColdFusion (2023 release) Update 11 and ColdFusion (2021 release) Update 17.    The updates include bug fixes and enhancements in Administrator, Language, CFSetup, Database, and other areas. They also contain library upgrades, such as netty, ehcache, etc.   After applying the update, we recommend clearing the Felix cache as a workaround for installing the HTMLToPDF package and verifying the Oracle data source.   The updates also contain enhancements to whitespace management and client variable support in CFPM.   Where do I download the updates from Download the updates from the following locations: ColdFusion (2023 release) Updates ColdFusion (2021 release) Updates   For more information, view the following tech notes: ColdFusion (2023 release) Update 11 ColdFusion (2021 release) Update 17   Known issues in the update The PDF Services page in ColdFusion Administrator does no

[cf]\cfusion\wwwroot\cf_scripts\scripts\ajax\ckeditorOur internal vulnerabity scan refers to the above folder (ckeditor) in the ColdFusion 2021 installation path as vulnerable which is also mapped to the webiste as a virutual directory. How can we fix this issue and pass the vulnerability test.

The update 17 was installed on 10/23/2024. This morning the ColdFusion application server cannot be started through Windows Services. I then use cfstart.bat running as Administrator to start the server, it stuck at the following step without success.Dec 6, 2024 09:12:38 AM Information [main] - Package spreadsheet started...Dec 6, 2024 09:13:15 AM Information [Timer-0] - An error has occurred while sending usage data to server.

When I login to the ColdFusion 2021 Administrator pages and select Server Settings -> Settings Summary -> System Information, the operating system shown is incorrectly displayed. The installation is on Windows Server 2022 and the display shows Windows Server 2016. Has anyone else seen this issue? I am concerned that there may be some corruption in the installation, as we have just applied Hotfix 16.

[BETA PROGRAM UPDATE] 4 Dec 2024 Created a post to announce deprecations and removals in the next release. Launched the top contributor contest. More sign-ups to the program. Added documentation of the earlier drops.   Get an exclusive sneak peek at what’s next for ColdFusion! Sign up for the ColdFusion 2025 Beta Program and get early access to shape the future with us. Engage with the community in the forums, share your thoughts, and keep up with the newest updates and features.   Join the Beta program   Exclusive deep-dive sessions will be hosted by the engineers who built each feature in ColdFusion 2025.    Check out the session details here.   Join the Beta program and help shape the future of ColdFusion. We're counting on you!

I've installed ColdFusion2023  on a server behind a firewall.  I've updated it with Update 7 and Update 11I've entered a valid license number and hit "Activate".  After the action fails and the "no internet connection...etc" error is displayed, there is no "Generate Activation Request" link/button. I'm not sure if its relevent, but during the installation, for the Deployment Type, I choose “Development” and for the Server Profile, I chose “Development Profile”. 

I need to download CF 21 for use on my local machine only. (free version)Windows 64-bitWhat do I want to download from this page?https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads1: 

I downloaded the trial of Coldfusion 10 64 bit for windows and have tried multiple times to open it on my Windows 2008 Server.  When I double click the EXE, the hourglass spins for a few seconds, and then nothing happens.  I've rebooted and the same thing happens.  I have also tried installing the 32-bit version on my windows XP computer and the same thing happens.  What am I doing wrong?  Thanks in advance!

I was forced to upgrade from Coldfusion 2018 to Coldfusion 2021, update 16.  For our database connection we are using the Oracle wallet to use ssl authentication.  This was working fine in 2018.  Now with the upgrade it stopped working.  The error is this:java.sql.SQLNonTransientConnectionException: [DataDirect][Oracle JDBC Driver]Error during renegotiation of SSL socket. I found this article on the same error that occurred with a version of the datadirect drivers:https://community.progress.com/s/article/Unable-to-get-JDBC-connection-to-SSL-enabled-multitenant-Oracle-database-with-HostNameInCertificate-option My question is, I know the version shipped with coldfusion 2021 is 6.0, but what is the patch/build version?  I want to compare it against what is in the progress datadirect article to see if that is the problem.  I already tried updating to CF update 17 for 2021, and that mucked up our other database connection as well, so I uninstalled it

Dear all,I'm trying  to solve the vulnerability in object, following the guide at Log4j vulnerability on ColdFusion (adobe.com),  but there are step not clear to me (in red my doubts):ColdFusion (2018 release)ColdFusion 2018 ships with log4j 2.13.3 and/or 2.9.0, and log4j 1.2. The former is impacted by this vulnerability, while the latter (that is, v1.2) is not impacted. Stop the server. Navigate to the directory <cf_root>\<Instance_name>\bin.Open jvm.config file and add -Dlog4j2.formatMsgNoLookups=true argument in java.args section. Save the file.Done Copy the patched log4j-core-2.9.0.jar file with JNDILookUp class that you have removed.Removed? I didn't remove anything until now. And copy where?The new file can be downloaded from here. If you find log4j-core-2.9.0.jar, move the file to a temporary location. If not found, skip this step.If I find it... if not found... W

dailyStatus = "select * from MyTasks ";if(Len(custom.ORDER)){            dailyStatus = dailyStatus & custom.ORDER;        }        else if (isDefined("URL.OrderBy") AND Len(URL.OrderBy)){            dailyStatus = dailyStatus & " ORDER BY " & "?" & " " & "?";            arrayAppend(params,{value:URL.OrderBy,cfsqltype:"cf_sql_varchar"});            arrayAppend(params,{value:URL.Direction,cfsqltype:"cf_sql_varchar"});        }        else{            dailyStatus = dailyStatus & "ORDER BY TimeRemaining, LastModifiedDate";        }        qryList = QueryExecute(dailyStatus, params, {datasource = REQUEST.CFG.DS}); This doesn't seem to work , because I'm getting error, Error Executing Database

I have problems with the mod_jk.log file, it grows exponentially until it runs out of space on the hard driveWindows Server 2022ColdFuision 2023Apache 2.4.62 (64Bits).<Connector packetSize="65535" protocol="AJP/1.3" address="::1" port="8022" redirectPort="8455" secret="9c59d633-9c26-4560-bf94-85faf8a3f382" maxThreads="500" connectionTimeout="60000" tomcatAuthentication="false"/> File mod_jk.log:[Wed Nov 27 17:02:10 2024] [10736:5656] [debug] wc_get_worker_for_name::jk_worker.c (157): found a worker cfusion[Wed Nov 27 17:02:10 2024] [10736:5656] [debug] wc_get_name_for_type::jk_worker.c (341): Found worker type 'ajp13'[Wed Nov 27 17:02:10 2024] [10736:5656] [debug] ajp_get_endpoint::jk_ajp_common.c (3779): (cfusion) acquired connection pool slot=0 after 0 retries[Wed Nov 27 17:02:10 2024] [10736:5656] [debug] ajp_marshal_into_msgb::jk_ajp_common.c (763): (cfusion) ajp marshaling done[Wed Nov 27 17:02:10 2024] [10736:5656] [debug] ajp_service::jk_ajp_common.c (2809): processin