2024-04-02 Weekly News — Episode 213
Watch the video version on YouTube at https://youtube.com/live/Vg81ar7GfW4?feature=share
Hosts:
- Eric Peterson - Senior Developer at Ortus Solutions
- Grant Copley - Senior Developer at Ortus Solutions
Thanks to our Sponsor - Ortus Solutions
The makers of ColdBox, CommandBox, ForgeBox, TestBox and all your favorite box-es out there.
A few ways to say thanks back to Ortus Solutions:
- Buy workshop tickets to CF Summit East
- Event Date: April 24, 2024
- Hosted By: Adobe & Carahsoft
- Location: Reston, VA
- Buy Tickets to Into the Box 2024 in Washington DC https://www.intothebox.org/
- MAY 15th - 17th,2024 - Washington, DC
- Like and subscribe to our videos on YouTube.
- Help ORTUS reach for the Stars - Star and Fork our Repos
- Star all of your Github Box Dependencies from CommandBox with https://www.forgebox.io/view/commandbox-github
- Subscribe to our Podcast on your Podcast Apps and leave us a review AND WE WILL READ IT ON THE SHOW
- Sign up for a free or paid account on CFCasts, which is releasing new content regularly
- BOXLife store: https://www.ortussolutions.com/about-us/shop
- Buy Ortus’s Books
- 102 ColdBox HMVC Quick Tips and Tricks on GumRoad (http://gum.co/coldbox-tips)
- Now on Amazon! In hardcover too!!!
- https://www.amazon.com/dp/B0CJHB712M
- Learn Modern ColdFusion (CFML) in 100+ Minutes - Free online https://modern-cfml.ortusbooks.com/ or buy an EBook or Paper copy https://www.ortussolutions.com/learn/books/coldfusion-in-100-minutes
Patreon Support (phenomenal)
We have 46 patreons:
https://www.patreon.com/ortussolutions.
News and Announcements
CVE-2024-20767: Critical Adobe ColdFusion Flaw Exposes Sensitive Files, PoC Published
Security researcher ma4ter has revealed details of a dangerous security vulnerability (CVE-2024-20767) in Adobe ColdFusion, also, another researcher published the proof-of-concept (PoC) exploit code. This flaw originally reported to Adobe, could be exploited to read arbitrary files on an affected server, potentially exposing highly confidential information. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.
- Patch released on March 12, 2024.
- Only vulnerable if you had the Performance Monitoring Toolset enabled and accessible via /pms.
https://securityonline.info/cve-2024-20767-critical-adobe-coldfusion-flaw-exposes-sensitive-files-poc-published/
https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html
New Releases and Updates
New Adobe Releases
Key enhancements include:
- Scope Variable Changes: Enhanced functionality for optimized performance.
- CFDocument Updates: Upgrades for smoot
Popular Podcasts
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
24/7 News: The Latest
The latest news in 4 minutes updated every hour, every day.
Therapy Gecko
An unlicensed lizard psychologist travels the universe talking to strangers about absolutely nothing. TO CALL THE GECKO: follow me on https://www.twitch.tv/lyleforever to get a notification for when I am taking calls. I am usually live Mondays, Wednesdays, and Fridays but lately a lot of other times too. I am a gecko.