CVSS: 7.5EPSS: 0%CPEs: 48EXPL: 0CVE-2012-4022
https://notcve.org/view.php?id=CVE-2012-4022
08 Nov 2012 — Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment. Pebble antes de v2.6.4 permite a atacantes remotos provocar una pérdida de visibilidad de entradas del blog a través de un comentario creado para tal fin. • http://jvn.jp/en/jp/JVN75492883/index.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.7EPSS: 0%CPEs: 48EXPL: 0CVE-2012-4023
https://notcve.org/view.php?id=CVE-2012-4023
08 Nov 2012 — CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Vulnerabilidad de inyección CRLF en Pebble antes de v2.6.4 permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de división de respuesta HTTP a través de vectores no especificados. • http://jvn.jp/en/jp/JVN39563771/index.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 50EXPL: 0CVE-2012-5170
https://notcve.org/view.php?id=CVE-2012-5170
04 Nov 2012 — Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Una vulnerabilidad de redirección abierta en Pebble antes de v2.6.4 permite a atacantes remotos redirigir a los usuarios a sitios web de su elección y llevar a cabo ataques de phishing a través de vectores no especificados. • http://jvn.jp/en/jp/JVN55398821/index.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 3CVE-2010-4904 – Joomla! Component Aardvertiser 2.1 - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2010-4904
08 Oct 2011 — SQL injection vulnerability in the Aardvertiser (com_aardvertiser) component 2.1 and 2.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_name parameter in a view action to index.php. NOTE: some of these details are obtained from third party information. Vulnerabilidad de inyección SQL en el componente Aardvertiser (com_aardvertiser) v2.1 y v2.1.1 para Joomla! que permite a atacantes remotos ejecutar comandos SQL a través del parámetro cat_name en una acción de index.php. • https://www.exploit-db.com/exploits/14922 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 10EXPL: 0CVE-2011-0432
https://notcve.org/view.php?id=CVE-2011-0432
14 Mar 2011 — Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de inyección SQL en la clases MySQLAuthHandler en DAVServer/mysqlauth.py de PyWebDAV en versiones anteriores a v0.9.4.1 , permite a atacantes remotos ejecutar comandos SQL... • http://code.google.com/p/pywebdav/updates/list • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2010-3028
https://notcve.org/view.php?id=CVE-2010-3028
16 Aug 2010 — The Aardvertiser component before 2.2.1 for Joomla! uses insecure permissions (777) in unspecified folders, which allows local users to modify, create, or delete certain files. El componente Aardvertiser en versiones anteriores a la v2.2.1 de Joomla! utiliza permisos inseguros (777) en carpetas sin especificar, lo que permite a usuarios locales modificar, crear o borrar determinados ficheros. • http://secunia.com/advisories/40882 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2010-1013
https://notcve.org/view.php?id=CVE-2010-1013
19 Mar 2010 — SQL injection vulnerability in the Diocese of Portsmouth Database (pd_diocesedatabase) extension before 0.7.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la extensión Diocese of Portsmouth Database (pd_diocesedatabase) anteriores a v0.7.13 para TYPO3 permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores sin especificar. • http://osvdb.org/63034 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 3%CPEs: 2EXPL: 4CVE-2010-0985 – Joomla! Component com_abbrev - Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-0985
16 Mar 2010 — Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information. Vulnerabilidad de salto de directorio en el componente Abbreviations Manager (com_abbrev) v1.1 para Joomla! • https://www.exploit-db.com/exploits/10948 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2009-4394
https://notcve.org/view.php?id=CVE-2009-4394
22 Dec 2009 — SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la extension Random Prayer 2 (ste_prayer2) v0.0.3 para TYPO3 permite a atacantes remotos ejecutar comandos SQL de forma arbitraria a través de vectores sin especificar. • http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2009-4395
https://notcve.org/view.php?id=CVE-2009-4395
22 Dec 2009 — Cross-site scripting (XSS) vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la extensión Random Prayer v2 (ste_prayer2) v0.0.3 y anteriores para TYPO3 permite a atacantes remotos inyectar secuencias de comandos web o HTML de forma arbitraria a través de vectores sin especificar. • http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •