CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 4CVE-2010-4838 – Joomla! Component JSupport 1.5.6 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-4838
SQL injection vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote authenticated users, with Public Back-end permissions, to execute arbitrary SQL commands via the alpha parameter in a (1) listTickets or (2) listFaqs action to administrator/index.php. Una vulnerabilidad de inyección SQL en el componente JSupport (com_jsupport) v1.5.6 para Joomla! permite ejecutar comandos SQL a usuarios remotos autenticados, con permisos de back-end publicos, a través del parámetro alpha en una accion (1) listTickets o (2) listFaqs en administrator/index.php. • https://www.exploit-db.com/exploits/15502 http://packetstormsecurity.org/files/view/95797/joomlajsupport-sql.txt http://secunia.com/advisories/42262 http://securityreason.com/securityalert/8379 http://www.exploit-db.com/exploits/15502 http://www.xenuser.org/documents/security/Joomla_com_jsupport_SQLi.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 3%CPEs: 2EXPL: 4CVE-2010-4837 – Joomla! Component JSupport 1.5.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-4837
Cross-site scripting (XSS) vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the subject parameter (title field) in a saveTicket action to index2.php. NOTE: some of these details are obtained from third party information. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el componente JSupport (com_jsupport) v1.5.6 para Joomla! permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro subject (campo de título) en una acción saveTicket a index2.php. • https://www.exploit-db.com/exploits/15501 http://packetstormsecurity.org/files/view/95796/joomlajsupport-xss.txt http://secunia.com/advisories/42262 http://securityreason.com/securityalert/8377 http://www.exploit-db.com/exploits/15501 http://www.xenuser.org/documents/security/Joomla_com_jsupport_XSS.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 49EXPL: 2CVE-2011-2710
https://notcve.org/view.php?id=CVE-2011-2710
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component. NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Joomla! before v1.7.0, permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de(1) la URI sobre includes/application.php, accesible desde index.php; y, cuando de usa Internet Explorer o Konqueror, (2) permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro searchword en una acción search sobre index.php en el componente com_search. • http://developer.joomla.org/security/news/357-20110701-xss-vulnerability.html http://www.openwall.com/lists/oss-security/2011/07/22/1 http://www.openwall.com/lists/oss-security/2011/07/22/5 http://www.openwall.com/lists/oss-security/2011/10/16/1 http://www.openwall.com/lists/oss-security/2011/11/21/27 http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-rc%5D_cross_site_scripting%28XSS%29 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 24EXPL: 1CVE-2011-2889
https://notcve.org/view.php?id=CVE-2011-2889
templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488. templates/sistema/error.php en Joomla! anterior a v1.5.23 podría permitir a atacantes remotos obtener información sensible a través de vectores no especificados que provocan un valor indefinido de un campo de error concreto, lo que lleva a la divulgación de la ruta de instalación. NOTA: esto podría superponerse a CVE-2011-2488. • http://developer.joomla.org/security/news/9-security/10-core-security/340-20110401-core-information-disclosure.html http://www.joomla.org/announcements/release-news/5367-joomla-1523-released.html http://www.openwall.com/lists/oss-security/2011/07/01/1 https://exchange.xforce.ibmcloud.com/vulnerabilities/68883 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 25EXPL: 1CVE-2011-2890
https://notcve.org/view.php?id=CVE-2011-2890
The MediaViewMedia class in administrator/components/com_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attackers to obtain sensitive information via vectors involving the base variable, leading to disclosure of the installation path, a different vulnerability than CVE-2011-2488. La clase MediaViewMedia en administrator/components/com_media/opiniones/media/view.html.php en Joomla! v1.5.23 y anteriores permite a atacantes remotos obtener información sensible a través de vectores que implican la variable base, lo que lleva a la divulgación de la ruta de instalación, una vulnerabilidad diferente a CVE-2011-2488. • http://www.openwall.com/lists/oss-security/2011/07/01/1 https://exchange.xforce.ibmcloud.com/vulnerabilities/68882 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •