CVSS: 2.6EPSS: 0%CPEs: 1EXPL: 1CVE-2013-5951 – Joomla eXtplorer 2.1.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2013-5951
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) application.js.php in scripts/ or (2) admin.php, (3) copy_move.php, (4) functions.php, (5) header.php, or (6) upload.php in include/. Múltiples vulnerabilidades de XSS en eXtplorer 2.1.3, cuando se utiliza como componente para Joomla!, permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través del PATH_INFO hacia (1) application.js.php en scripts/ o (2) admin.php, (3) copy_move.php, (4) functions.php, (5) header.php o (6) upload.php en include/. Joomla eXtplorer component version 2.1.3 suffers from a cross site scripting vulnerability. • http://archives.neohapsis.com/archives/fulldisclosure/2014-03/0273.html http://secunia.com/advisories/57387 http://secunia.com/advisories/57482 http://www.debian.org/security/2014/dsa-2882 http://www.securityfocus.com/bid/66262 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.6EPSS: 0%CPEs: 1EXPL: 0CVE-2012-3454
https://notcve.org/view.php?id=CVE-2012-3454
eXtplorer 2.1.0b6 uses world writable permissions for the /var/lib/extplorer/ftp_tmp directory, which allows local users to delete or overwrite arbitrary files. eXtplorer v2.1.0b6 utiliza permisos de escritura para el directorio /var/lib/extplorer/ftp_tmp, que permite a los usuarios locales borrar o sobreescribir archivos arbitrarios. • http://www.openwall.com/lists/oss-security/2012/08/03/7 http://www.securityfocus.com/bid/54801 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 1CVE-2012-3362
https://notcve.org/view.php?id=CVE-2012-3362
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action. Una vulnerabilidad de falsificación de solicitudes en sitios cruzados(CSRF) en eXtplorer v2.1 RC3 y anteriores permite a atacantes remotos secuestrar la autentificación de los administradores para las peticiones que añaden una cuenta de administrador a través de una acción de administración adduser. • http://www.autosectools.com/Advisories/eXtplorer.2.1.RC3_Cross-site.Request.Forgery_174.html http://www.debian.org/security/2012/dsa-2510 http://www.openwall.com/lists/oss-security/2012/06/24/1 http://www.openwall.com/lists/oss-security/2012/06/25/1 http://www.openwall.com/lists/oss-security/2012/06/26/1 http://www.openwall.com/lists/oss-security/2012/06/27/1 • CWE-352: Cross-Site Request Forgery (CSRF) •