CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2013-3267
https://notcve.org/view.php?id=CVE-2013-3267
03 May 2013 — Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el plugin highlighter en Joomla! v2.5.x anterior a v2.5.10 y v3.0.x anterior a v3.0.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2013-1454
https://notcve.org/view.php?id=CVE-2013-1454
13 Feb 2013 — Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to "Coding errors." Joomla! v3.0.x hasta v3.0.2 permite a atacantes obtener información sensible a través de vectores no especificados en relación con "errores de codificación". • http://developer.joomla.org/security/news/550-20130203-core-information-disclosure.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-1455
https://notcve.org/view.php?id=CVE-2013-1455
13 Feb 2013 — Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to an "Undefined variable." Joomla! v3.0.x hasta v3.0.2 permite a atacantes obtener información sensible a través de vectores no especificados en relación con una "variable no definida". • http://developer.joomla.org/security/news/549-20130202-core-information-disclosure.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 12EXPL: 2CVE-2013-1453 – Joomla! 3.0.2 - 'highlight.php' PHP Object Injection
https://notcve.org/view.php?id=CVE-2013-1453
13 Feb 2013 — plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information, but later analysis demonstrated that other attacks exist. El archivo plugins/system/highlight/highlight.... • https://www.exploit-db.com/exploits/24551 •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2012-6503
https://notcve.org/view.php?id=CVE-2012-6503
24 Jan 2013 — Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors. Vulnerabilidad no especificada en el componente NinjaXplorer anterior a v1.0.7 para Joomla! tiene un impacto desconocido y vectores de ataque. • http://ninjaforge.com/blog/318-security-vulnerability-discovered-in-ninjaxplorer-upgrade-immediately •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2012-6514
https://notcve.org/view.php?id=CVE-2012-6514
24 Jan 2013 — Cross-site scripting (XSS) vulnerability in the nBill (com_nbill) component 2.3.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php. Una vulnerabilidad de tipo cross-site scripting (XSS) en el componente nBill (com_nbill) versión 2.3.2 para Joomla!, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro message en una acción income en el archivo administrator/index.php. • http://hauntit.blogspot.com/2012/04/en-nbill-lite-joomla-component-html.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 27EXPL: 0CVE-2012-1598
https://notcve.org/view.php?id=CVE-2012-1598
03 Dec 2012 — Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerability." Joomla! v1.5.x antes de 1.5.26 tiene un impacto no especificado y vectores de ataque relacionados con una "aleatoriedad insuficiente" y una "vulnerabilidad de restablecimiento de contraseña". • http://developer.joomla.org/security/news/396-20120305-core-password-change.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 27EXPL: 0CVE-2012-1599
https://notcve.org/view.php?id=CVE-2012-1599
03 Dec 2012 — Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end information" via unknown vectors. NOTE: this might be a duplicate of CVE-2012-1611. Joomla! v1.5.x antes de v1.5.26 no comprueba correctamente los permisos, lo que permite a los atacantes obtener información sensible del backend a través de vectores desconocidos. • http://developer.joomla.org/security/news/397-20120306-core-information-disclosure.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 8%CPEs: 4EXPL: 3CVE-2010-5280 – Joomla! Component Community Builder Enhanced (CBE) 1.4.8/1.4.9/1.4.10 - Local File Inclusion / Remote Code Execution
https://notcve.org/view.php?id=CVE-2010-5280
26 Nov 2012 — Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabname parameter in a userProfile action to index.php. NOTE: this can be leveraged to execute arbitrary code by using the file upload feature. Una vulnerabilidad de Salto de directorio en el componente Enhanced Community Builder (CBE) (com_cbe) v1.4.8, v1.4.9 y v1.4.10 para Joomla! • https://www.exploit-db.com/exploits/15222 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 38%CPEs: 2EXPL: 2CVE-2010-5286 – Joomla! Component Jstore - 'Controller' Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-5286
26 Nov 2012 — Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. Vulnerabilidad de salto de directorio en el componente Jstore (com_jstore) para Joomla! permite a atacantes remotos leer archivos de su elección y posiblemente tener otro impacto no especificado a través de un .. • https://www.exploit-db.com/exploits/34837 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •