CVSS: 6.8EPSS: 0%CPEs: 14EXPL: 0CVE-2009-1280
https://notcve.org/view.php?id=CVE-2009-1280
Multiple cross-site request forgery (CSRF) vulnerabilities in the com_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. Múltiples vulnerabilidades de falsificación de petición de sitios cruzados en el componente com_media para Joomla! v1.5.x hasta v1.5.9 permite a atacantes remotos secuestrar la autentificación de de víctimas no especificadas mediante vectores desconocidos. • http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html http://secunia.com/advisories/34551 https://exchange.xforce.ibmcloud.com/vulnerabilities/49656 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.5EPSS: 0%CPEs: 35EXPL: 0CVE-2008-6299
https://notcve.org/view.php?id=CVE-2008-6299
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the com_weblinks module and (2) unspecified vectors in the com_content module related to "article submission." Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados - XSS - en Joomla! v1.5.7 y anteriores, permite a usuarios autentificados remotos inyectar una secuencia de comandos web o HTML a través de (1) los parámetros "title" y "descripción" en el módulo com_weblinks y (2) vectores no especificados cen el modulo com_content relativo a "article submission.". • http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.html http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.html http://secunia.com/advisories/32622 http://www.joomla.org/announcements/release-news/5219-joomla-158-released.html http://www.securityfocus.com/bid/32263 http://www.vupen.com/english/advisories/2008/3104 https://exchange.xforce.ibmcloud.com/vulnerabilities/46523 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2008-6275
https://notcve.org/view.php?id=CVE-2008-6275
Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified messages. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo User Karma v5.x anterior a v5.x-1.13 y v6.x anterior a v6.x-1.0-beta1 para Drupal, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de mensajes no especificados. • http://drupal.org/node/339553 http://osvdb.org/50208 http://secunia.com/advisories/32904 http://www.securityfocus.com/bid/32491 https://exchange.xforce.ibmcloud.com/vulnerabilities/46947 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 0CVE-2008-6276
https://notcve.org/view.php?id=CVE-2008-6276
Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via (1) a content type or (2) a voting API value. Múltiples vulnerabilidades de inyección SQL en el módulo User Karma v5.x anterior a v5.x-1.13 y v6.x anterior a v6.x-1.0-beta1 para Drupal, permite a administradores autenticados remotamente ejecutar comandos SQL de su elección a través de (1) un tipo de contenido o (2) un valor "voting API". • http://drupal.org/node/339553 http://osvdb.org/50207 http://secunia.com/advisories/32904 http://www.securityfocus.com/bid/32491 https://exchange.xforce.ibmcloud.com/vulnerabilities/46946 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 2%CPEs: 30EXPL: 2CVE-2009-0113 – Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal
https://notcve.org/view.php?id=CVE-2009-0113
Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the X_CMS_LIBRARY_PATH HTTP header. Vulnerabilidad de salto de directorio en attachmentlibrary.php en el componente XStandard para Joomla! v1.5.8 y versiones anteriores permite a atacantes remotos listar directorios de su elección a través de .. • https://www.exploit-db.com/exploits/7691 http://secunia.com/advisories/33377 http://securityreason.com/securityalert/4896 http://www.securityfocus.com/bid/33143 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •