Questions

Is there a remediation solution CVE-2022-34169 vulnerability for ColdFusion 2016?

We have an ajax request that got a "400 bad request" response from our server. The weird thing is, the request got fully processed by CF. How is that possible?Is it possible for the server to see the request as "bad", yet it still allows it to be processed?

Every once in a while it happens. Someone inadvertently has a file, "filename.cfm" with an include like <cfinclude template="filename.cfm"> and it is as simple as that... when requested an infinite loop situation is at hand and the server goes down. On a very large site with multiple developers, this is almost inevitable, so... Is there a way I can configure CF or use CFInclude so that this doesn't happen? thanks, Chuck

My localhost (development) server is in a state with a few known items. One of which it is "Not able to connect to Update Site" due to some missing bouncycastle stuff - that was corrected in an update if I recall correctly. PARADOX: The updater cannot run the updates required to fix the updater. Searching produces a plethora of links and blogs on how to update CF manually, but they tend to vary widly based on age, version and platform. Thus my question:Where are the pentultimate, correct and authorative instructions for manual updating of:Adobe ColdFusion 2021 Version 2021,0,03,329779Developer edition running on UNIX (Linux distro Zorin OS 16.1) 64 bit Send me one of the many items writen for Windows, and I will shake my first and curse your username skyward in a manner that would make William Shatner weep. You have my gratitude! 

Dear Community,We have received a high alert from our Palo Alto protection tool.We have 2 questions:- who knows the IP address 45.77.185.211:443?- who knows what the system file auditd64.bin does? This file is used in the following command line: "cmd" /c "cd /d "C:/ColdFusion2016/cfusion/bin/"&c:\windows\system\auditd64.bin 2>&1"Thank you in adavance for your assistance,Eric

I have a website that is running the foloowing script.<CFQUERY NAME="CreateFile" DATASOURCE="#xxxxxxx#"> INSERT INTO tblxxxxx(LicenseID, CompanyID, LocationID, Company_Status, Company_Type, SYS_EntryDateTime)VALUES('#LicenseID#', '#CompanyID#', '#LocationID#', '#Company_Status#', '#Company_Type#','#DateFormat(Now(), "MM/DD/YYYY")# #TimeFormat(Now(), "h:mm tt")#')</CFQUERY>and if I look at the query run on mssql, here is what I get('xxxxxxxxxxxxxxxxxxxx', 'xxxxxxxxxxxxxxxxxxxxx', 'xxxxxxxxxxxxxxxxxxxx', '3', '6', '08/237/2022 12:05 PM')The month value should have been 25, not 237 which is invalid.Any thoughts would be appreciated. 

Our webservice is thorwing out this error.We are running Cold Fusion 2021 Update 4 on Windows 2019 The most recent thing we changed was the TLS 1.2 lock down.I reverted all the TLS registry changes but it didnt fix anything.I am not 100% its even related.The only other thing that happened between last time it worked, was regular windows updates.NO code changes to the web service or site code.org.apache.axis2.AxisFault: Stream closed at org.apache.axis2.util.Utils.getInboundFaultFromMessageContext(Utils.java:531) at org.apache.axis2.description.OutInAxisOperationClient.handleResponse(OutInAxisOperation.java:375) at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:421) at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:229) at org.apache.axis2.client.OperationClient.execute(OperationClient.java:165) at ws.internal.WsInternalInstallsCfcStub.getCurrentVersions(WsInternalInstallsCfcStub.java:192) at java

My internal security scans are still going nuts when scanning the Coldfusion server in regard to CKEditor.  Is there a manual way to upgrade from the installed 4.10 to at least the 4.16 version to plug a bunch of holes?  Or even better the current 4.17 version on the 4.X stack.

We have a scheduled task that scrubs an inbox regularly and has been running like clockwork since January 2022. This sunday our IT team updated the JDK to 11.0.6 and it started timing out. I've cut the task down to the bare bones and is it still taking multiple minutes to load a single email. I wanted to know if anyone else is experiencing anything like this. Our CF version: 2018.0.14.330003The pared down code for the scheduled task:<cfparam name="url.folder" default="inbox"/> <cfparam name="url.maxrows" default="10"/> <cfparam name="url.startRow" default="1"/> <cftry> <cfset local.email_username = [USER_NAME] /> <cfset local.email_password = [USER_PASS] /> <cfimap action="open" server="imap.gmail.com" port="993" username="#local.email_username#" password="#local.email_password#" secure="yes" connection = "test.cf.gmail" /> <!--- get all messages from IMAP server ---> <cfimap action="g

Is there a way to undo the ColdFusion 2021 lockdown tool?I was following the lockdown guide and did skip one step (Setting up a separate drive to host my website files) which may be the cause of my problems: After running the lock down software for ColdFusion 2021, I can only partially access my IIS-based sites by using 127.0.0.1, and that is only partially. Otherwise, I am hitting server errors such as:"The requested page cannot be accessed because the related configuration data for the page is invalid.  Cannot add duplicate collection entry of type 'add' with unique key attribute 'url' set to '/jakarta/isapi_redirect.dll'"I am sure it is some sort of file permissions error, but I have no idea where to start to restore my site.Thank you

Greetings.I have a need to connect to a file server to read and zip up some files. I am looking for either a solution to the problem, or a definitive "that will not work" We have a windows based CF2018 server in our DMZ.The DMZ is disconnected from the domain as such I can not run CF as a domain user such as cf@mydomain.com Currently the CF service is running under a local admin accout ex. 'svcCF' Logging in to the Windows server as the local dmin  'scvCF', I have mapped a network drive ex. Z: to a network location '\\myserver.mydomain\myfolder' using the credentials of a domain user with permissions on that machine. I am then trying: <cfdirectory action="list" directory="Z:\700 Series\" recurse="false" name="myList"><cfdump var="#myList#"> With an empty result. My guess is just because the local admin account svcCF has a mapped drive (using a different user's credentials to connect) doesnt mean the CF service sunning as the loca

I have a db connection( xxxdev2) on a UAT server.I am trying to setup a duplicate db( xxxdev2b) opn my local server to test db failover if the primary server goes down.For some reason, I connot get the connection working in the coldfusion Datasource section.I can login in to the server using sql studio, but I get the following error on the datsopurce page of CF. "Connection verification failed for data source: xxxdev2bjava.sql.SQLNonTransientConnectionException: [Macromedia][SQLServer JDBC Driver]Error establishing socket to host and port: LAPTOP-Rick:1433. Reason: Connection refused: connect"

We're trying to implement a connection to the Google Firebase Firestore database.In java, as explained by firebase documentation, one should add a depencency as follows:dependencies {  implementation 'com.google.firebase:firebase-admin:6.7.0'}This way there's access to FirebaseApp and FirebaseOptions classes.How can we do this in ColdFusion? Tnx!

Hello,I am being asked about our JDK/JRE usage at the School District by what appears to be a legit Oracle representative.I assumed our Cf license covers everything ... but am afraid to answer the email, can't imagine we would have to buy JRE licenses now on top of the Cf license ??Part of his email:I ask because the changes with Java licensing impact uses cases of Java beyond development. For example, if you use Java Runtime (JRE) for 3rd party applications, you could be impacted by these changes depending on what versions/ updates of JRE you have installed.Please let me know if you do have any Java instances installed on any of your desktops or servers so we can figure out if we should discuss this topic further Thoughts ? I checked the servers we have 2016 and 2018 .... looks like the JRE is Oracle and not OpenJDK Thanks

ProblemI have a web application that makes extensive use of websockets for call center agents. There are up to 50 simultaneous users who are triggering messages and listening on channels for chat, phone calls and broadcast messaging. After about a month in production (and, with no issues), we had two failures yesterday where messages stopped being processed. So far, it is unclear if the .cfc extension handlers were receiving the browser websocket messages during the failure, but it is positive that the server was not publishing back out to the browser listeners.When I searched the CF and IIS logs, there is NO record of any anomalous events during the stalled periods (application.log, exception.log, etc...). Restarting the ColdFusion Application Service causes messages to start flowing immediately, but there is no recovery (no catching up) for messages sent during the stall.All other website functionality appeared to be working properly during the stall.I'm awaiting the next failure so

Hi all,I currently use standard authentication butI need to know if CF11 supports modern authentication (office 365). RegardsFederico

<cfset schedindtl.presstime = 230> <cfset schedindtl.pressdate = 20090308> <cfset pressstart = #createdatetime(mid(schedindtl.pressdate,1,4),mid(schedindtl.pressdate,5,2),mid(schedindtl.pressdate,7,2),int(schedindtl.presstime/100),int(right(tostring(schedindtl.presstime),2)),0)#> pressstart = #pressstart# Looks like daylight savings time problem. Looking for help in fixing.

Hi all, I'ìve the CF 11 connected with Informix DB.in the application.log I found the following error. Can you help me to found the root cause?  many thanks "Error Executing Database Query.[Macromedia][Informix JDBC Driver]Connection reset by peer: socket write error The specific sequence of files included or processed is: G:\Inetpub\wwwroot\CFor\AccessoRiservato\_Include\PAGAMENTI\ContributiMinimi_PP\Stampe\F24Stampa.cfm, line: 643 "

Today I was changing the datasource for my client variables. I had initially specified a remote SQL Server database, but wanted to change it to a local SQL Server datasource. Apparently there was a permissions problem with the username I had specified for the datasource and it was causing a "select permission was denied error." Next thing I knew I was logged out of the ColdFusion 2021 Administrator and could not log back in. I kept getting "Invalid User name or Password. Please try again." I know I didn't change my password so this didn't make any sense. Just in case, however, I did use the passwordreset.BAT file in the ColdFusion/bin directory. But I still cannot login.I am on Windows Server 2019, and it is the trial version of Enterprise. (I am moving to a new server).Any help greatly appreciated. I would not want to have to start over setting this server up.Thank you.

Hello,I have recently updated coldfusion from 2016 to 2021, before update I used following code to write an excel file with cells containig dropdown list <!--- Create an instance of a new spreadsheet ---> <cfset spreadsheet = spreadsheetNew("My Spreadsheet", true)> <!--- we need all this so we can have dropdowns ---> <cfset workbook = spreadsheet.getWorkBook()> <cfset worksheet = workbook.getSheet("My Spreadsheet")> <cfset dataValidationConstraint = createObject("java","org.apache.poi.xssf.usermodel.XSSFDataValidationConstraint")> <cfset cellRangeList = createObject("java","org.apache.poi.ss.util.CellRangeAddressList")> <cfset dataValidationHelper = createObject("java","org.apache.poi.xssf.usermodel.XSSFDataValidationHelper").init(worksheet)> <!--- Define cell list rowstart, rowend, column start, column end ---> <cfset list = cellRangeList.init(0, 0, 0, 0)> <cfset dvconstraint = dataValidationHelper.createExplicitLis

Hi all,Can anybody help me in resolving this issue. The details are mentioned below.I am generating PDF using <cfdocument> tag of Cold Fusion.I have a header and footer to be displayed on each page. I am rendering data in a table. If rows in the table exceed a page , and continue on the next page , I want the table headers to be repeated on each of the page.Example :Currently this is happening:Page Header Sr NoNameOccupation1AA2BB3CCPage Footer : Page No 1Page Header 4AA5BB6CCPage Footer : Page No 2--------------------------------------------------------------------------------------------------------------------------------------------------------What I want is : Page Header Sr NoNameOccupation1AA2BB3CC Page Footer : Page No 1 Page header Sr NoNameOccupation4AA5BB6CC Page Footer : Page No 2

I have Azure Container Instance running Coldfusion 2021 on Linux Server.I am getting Connection verification failed for PDF Service Manager: localhost.Connect to 127.0.0.1:8993 [/127.0.0.1] failed: Connection refused (Connection refused) http://127.0.0.1:8993/PDFgServlet/verify How to resolve this issue?  

I have a form that has a file input with the multiple attribute set. This form might also have other file uploads.If I use the FileUpload function specifying the multi-file input it will only upload the first file. If I use the FileUploadAll I cannot specify an input name, and it will upload all documents from all upload fields. It doesn't retain any information about which field the files came from, so I now have a jumble of files that I cannot usefully assign anywhere.In the FORM variables we get temp file names e.g. "neotmp11170355642215183856.tmp", but there is no information that I can find that would allow me to cross reference this to the results of FileUploadAll.I did see a post about using binary read operating on the temp filenames in the FORM variable, but this won't help as there is no information available telling me what the uploaded file was supposed to be (pdf/doc/etc) and the original filename.Is there any way around this where I can upload multiple files from "fi

Hi! I have not used CF for a long time and I'm coming back to CF 2021. I kind of recall that the older CF generations abandon CFFORM and CFINPUT or if it wasn't abandon I did not use them in my codes because I remember many CF programmers suggested me not to use them as they cause or may cause many issues (couldn't remember what exactly after all these years). With the newer CF version since 2016 does CF fixed or revised CFFORM and CFINPUT tags and they are now safe to use? I prefer to use these tags if they are not causing issues as I build a lot of forms (simple mostly) and required form authentication for required fields and so on. Using CFFORM, CFINPUTs actually help me speed up my work instead of building javascript everytime. Thank you for validating my knowledge as I've been absent from CF for so long.

Register now!   Adobe Connect is a powerful, flexible application that lets you run webinars, conferences, open office hours, team meetings and more. One of the more useful capabilities is the option of building your own custom pods to handle workloads, provide interactivity and expand the capabilities of Connect. In this session, Mark Takata, Technical Evangelist for Adobe ColdFusion, will take you from 0 – 100 in building a custom Connect pod which leverages Adobe ColdFusion, JavaScript & MySQL to build a custom conference scheduling application. Special guest Alistair Lee will join us briefly to explain Connect’s incredible features & answer questions regarding the Connect SDK.   Register now!