CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7985
https://notcve.org/view.php?id=CVE-2017-7985
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components. El filtrado inadecuado de caracteres multibyte, en Joomla 1.5.0 hasta 3.6.5, puede derivar en vulnerabilidades XSS en varios componentes. El fallo se ha corregido en la versión 3.7.0. • http://www.securityfocus.com/bid/98020 http://www.securitytracker.com/id/1038817 https://developer.joomla.org/security-centre/685-20170403-core-xss-vulnerability https://fortiguard.com/zeroday/FG-VD-17-107 https://fortiguard.com/zeroday/FG-VD-17-108 https://fortiguard.com/zeroday/FG-VD-17-109 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 57EXPL: 0CVE-2017-7984
https://notcve.org/view.php?id=CVE-2017-7984
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component. Un inadecuado sistema de filtrado en Joomla! 3.2.0 hasta 3.6.5 permite realizar un ataque de cross-site scripting en el componente template manager. • http://www.securityfocus.com/bid/98018 https://developer.joomla.org/security-centre/684-20170402-core-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 137EXPL: 0CVE-2017-7986
https://notcve.org/view.php?id=CVE-2017-7986
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components. Un unadecuado sistema de filtrado de atributos HTML en Joomla! 1.5.0 hasta 3.6.5 permite realizar un ataque de cross-site scripting en varios componentes. • http://www.securityfocus.com/bid/98024 https://developer.joomla.org/security-centre/686-20170404-core-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 33EXPL: 0CVE-2016-9081
https://notcve.org/view.php?id=CVE-2016-9081
Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors. Joomla! 3.4.4 hasta la versión 3.6.3 permite a atacantes restablecer nombre de usuario, contraseña y asignaciones de grupo de usuarios y posiblemente realizar otras modificaciones de cuentas de usuario a través de vectores no especificados. • http://www.securityfocus.com/bid/93969 https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 96%CPEs: 3EXPL: 8CVE-2016-10045 – PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
https://notcve.org/view.php?id=CVE-2016-10045
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. El transporte isMail en PHPMailer en versiones anteriores a 5.2.20 podrían permitir a atacantes remotos pasar parámetros extra al comando de correo y consecuentemente ejecutar código arbitrario aprovechando una interacción inapropiada entre la función escapeshellarg y un escape interno realizado en la función mail en PHP. NOTA: esta vulnerabilidad existe debido a una incorrecta reparación de CVE-2016-10033. • https://www.exploit-db.com/exploits/42221 https://www.exploit-db.com/exploits/40969 https://www.exploit-db.com/exploits/40986 http://openwall.com/lists/oss-security/2016/12/28/1 http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html http://seclists.org/fulldisclosure/2016/Dec/81 http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection http://www.securityfocus& • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •