CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 3CVE-2009-4579
https://notcve.org/view.php?id=CVE-2009-4579
Cross-site scripting (XSS) vulnerability in the Artist avenue (com_artistavenue) component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php. Vulnerabilidad de secuencias de comandos (XSS) en el componente Artist avenue (com_artistavenue) para Joomla!, y Mambo permite a atacantes remotos ejecutar código web o HTML de su elección a través del parámetro Itemid en index.php. • http://packetstormsecurity.org/0912-exploits/joomlaartistavenue-xss.txt http://www.exploit-db.com/exploits/10818 http://www.securityfocus.com/bid/37537 https://exchange.xforce.ibmcloud.com/vulnerabilities/55214 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2009-4474 – Mambo Component com_zoom - 'catid' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-4474
SQL injection vulnerability in the Mike de Boer zoom (com_zoom) component 2.0 for Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. Vulnerabilidad de inyección SQL en el componente Mike de Boer zoom (com_zoom) v2.0 para Mambo permite a atacantes remotos ejecutar comandos SQl de forma arbitraria a través del parámetro "catid" a index.php. • https://www.exploit-db.com/exploits/9588 http://www.exploit-db.com/exploits/9588 http://www.securityfocus.com/bid/36281 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 3CVE-2009-4199 – Joomla! Component com_mosres - Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2009-4199
Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) property_uid parameter in a viewproperty action to index.php and the (2) regID parameter in a showregion action to index.php. Múltiples vulnerabilidades de inyección SQL en el componente Mambo Resident (aka Mos Res or com_mosres) v1.0f para Mambo y Joomla!, cuando está deshabilitado magic_quotes_gpc, permite a atacantes remotos ejecutar comandos SQL de su elección mediante (1) el parámetro "property_uid" en una acción viewproperty de index.php y (2) el parámetro "regID" en una acción showregion de index.php. • https://www.exploit-db.com/exploits/8872 http://www.exploit-db.com/exploits/8872 http://www.securityfocus.com/bid/35202 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 4%CPEs: 3EXPL: 3CVE-2008-7213 – Mambo Module MOStlyCE 2.4 - 'connector.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-7213
Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php en MOStlyCE y anteriores a la v2.4, como la usada en Mambo v4.6.3 y anteriores, permite a los atacantes remotos inyectar arbitrariamente una secuencia de comandos web o HTML a través del parámetro Command. • https://www.exploit-db.com/exploits/31066 http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html http://forum.mambo-foundation.org/showthread.php?t=10158 http://osvdb.org/42530 http://secunia.com/advisories/28670 http://www.bugreport.ir/index_33.htm http://www.securityfocus.com/archive/1/487128/100/200/threaded http://www.securityfocus.com/bid/27470 http://www.vupen.com/english/advisories/2008/0325 https://exchange.xforce.ibmcloud.com/vulnerabilities/39984 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 2%CPEs: 3EXPL: 2CVE-2008-7215
https://notcve.org/view.php?id=CVE-2008-7215
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command, which are used to modify equivalent variables in $_FILES that are accessed when the is_uploaded_file check fails. El Image Manager en MOStlyCE anteriores a v2.4, como las usadas en Mambo v4.6.3 y anteriores, permite a atacantes remotos renombrar ficheros de su elección y provocar una denegación de servicio a través de la modificación de los parámetros file[NewFile][name], file[NewFile][tmp_name], y file[NewFile][size] en un comando FileUpload, que es usado para modificar las variables equivalentes en $_FILES que son accedidas cuando la comprobación is_uploaded_file falla. • http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html http://forum.mambo-foundation.org/showthread.php?t=10158 http://osvdb.org/42532 http://secunia.com/advisories/28670 http://www.bugreport.ir/index_33.htm http://www.securityfocus.com/archive/1/487128/100/200/threaded http://www.securityfocus.com/bid/27472 http://www.vupen.com/english/advisories/2008/0325 https://exchange.xforce.ibmcloud.com/vulnerabilities/39986 • CWE-20: Improper Input Validation •