CVSS: 3.5EPSS: 0%CPEs: 35EXPL: 0CVE-2008-6299
https://notcve.org/view.php?id=CVE-2008-6299
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the com_weblinks module and (2) unspecified vectors in the com_content module related to "article submission." Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados - XSS - en Joomla! v1.5.7 y anteriores, permite a usuarios autentificados remotos inyectar una secuencia de comandos web o HTML a través de (1) los parámetros "title" y "descripción" en el módulo com_weblinks y (2) vectores no especificados cen el modulo com_content relativo a "article submission.". • http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.html http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.html http://secunia.com/advisories/32622 http://www.joomla.org/announcements/release-news/5219-joomla-158-released.html http://www.securityfocus.com/bid/32263 http://www.vupen.com/english/advisories/2008/3104 https://exchange.xforce.ibmcloud.com/vulnerabilities/46523 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 2%CPEs: 30EXPL: 2CVE-2009-0113 – Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal
https://notcve.org/view.php?id=CVE-2009-0113
Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the X_CMS_LIBRARY_PATH HTTP header. Vulnerabilidad de salto de directorio en attachmentlibrary.php en el componente XStandard para Joomla! v1.5.8 y versiones anteriores permite a atacantes remotos listar directorios de su elección a través de .. • https://www.exploit-db.com/exploits/7691 http://secunia.com/advisories/33377 http://securityreason.com/securityalert/4896 http://www.securityfocus.com/bid/33143 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 15%CPEs: 2EXPL: 3CVE-2008-5053 – Joomla! Component Simple RSS Reader 1.0 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2008-5053
PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter. Vulnerabilidad de inclusión de archivo PHP remoto en admin.rssreader.php en el componente Simple RSS Reader (com_rssreader) 1.0 para Joomla! permite a atacantes remotos ejecutar código PHP de su elección mediante un URL en el parámetro mosConfig_live_site. • https://www.exploit-db.com/exploits/7096 http://osvdb.org/49859 http://securityreason.com/securityalert/4584 http://www.exploit-db.com/exploits/7096 http://www.securityfocus.com/bid/32265 http://www.vupen.com/english/advisories/2008/3119 https://exchange.xforce.ibmcloud.com/vulnerabilities/46559 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2008-4102
https://notcve.org/view.php?id=CVE-2008-4102
Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak seed, which makes it easier for attackers to guess the pseudo-random values produced by PHP's mt_rand function, as demonstrated by guessing password reset tokens, a different vulnerability than CVE-2008-3681. Joomla! 1.5 anterior a v1.5.7 inicializa el PHP's PRNG con una semilla débil, lo que facilita a los atacantes obtener valores pseudo-aleatorios originados por la función PHP's mt_rand, como se ha demostrado obteniendo un reinicio de contraseña. Vulnerabilidad distinta de CVE-2008-3681. • http://developer.joomla.org/security/news/272-20080902-core-random-number-generation-flaw.html http://marc.info/?l=oss-security&m=122115344915232&w=2 http://marc.info/?l=oss-security&m=122118210029084&w=2 http://marc.info/?l=oss-security&m=122152798516853&w=2 http://secunia.com/advisories/31789 http://securityreason.com/securityalert/4271 http://www.securityfocus.com/archive/1/496237/100/0/threaded http://www.sektioneins.de/advisories/SE-2008-04.txt http://www.suspekt.org • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2008-4105
https://notcve.org/view.php?id=CVE-2008-4105
JRequest in Joomla! 1.5 before 1.5.7 does not sanitize variables that were set with JRequest::setVar, which allows remote attackers to conduct "variable injection" attacks and have unspecified other impact. JRequest en Joomla! 1.5 y versiones anteriores a 1.5.7 limpia correctamente variable establecidas con JRequest::setVar, el cual permite a los atacante remotos realizar un ataque de "inyección de variable" y tiene otras consecuencias no especificadas. • http://developer.joomla.org/security/news/271-20080901-core-jrequest-variable-injection.html http://marc.info/?l=oss-security&m=122115344915232&w=2 http://marc.info/?l=oss-security&m=122118210029084&w=2 http://marc.info/?l=oss-security&m=122152798516853&w=2 http://secunia.com/advisories/31789 http://securityreason.com/securityalert/4275 http://securitytracker.com/id?1020843 https://exchange.xforce.ibmcloud.com/vulnerabilities/45069 • CWE-20: Improper Input Validation •