CVSS: 9.8EPSS: 97%CPEs: 3EXPL: 26CVE-2016-10033 – WordPress PHPMailer Host Header Command Injection
https://notcve.org/view.php?id=CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property. La función mailSend en el transporte isMail en PHPMailer en versiones anteriores a 5.2.18 podrían permitir a atacantes remotos pasar parámetros extra al comando mail y consecuentemente ejecutar código arbitrario a través de una \" (barra invertida comillas dobles) en una propiedad Sender manipulada. PHPMailer version 5.2.17 suffers from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/41962 https://www.exploit-db.com/exploits/42024 https://www.exploit-db.com/exploits/41996 https://www.exploit-db.com/exploits/40974 https://www.exploit-db.com/exploits/42221 https://www.exploit-db.com/exploits/40970 https://www.exploit-db.com/exploits/40968 https://www.exploit-db.com/exploits/40969 https://www.exploit-db.com/exploits/40986 https://github.com/opsxcq/exploit-CVE-2016-10033 https://github.com/GeneralTesler/CVE- • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 97%CPEs: 95EXPL: 9CVE-2015-8562 – Joomla HTTP Header Unauthenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-8562
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015. Joomla! 1.5.x, 2.x y 3.x en versiones anteriores a 3.4.6 permite a atacantes remotos llevar a cabo ataques de inyección de objetos PHP y ejecutar código PHP arbitrario a través de la cabecera HTTP User-Agent header, como fue explotado en Diciembre 2015. • https://www.exploit-db.com/exploits/38977 https://www.exploit-db.com/exploits/39033 https://github.com/paralelo14/CVE-2015-8562 https://github.com/guanjivip/CVE-2015-8562 https://github.com/thejackerz/scanner-exploit-joomla-CVE-2015-8562 https://github.com/RobinHoutevelts/Joomla-CVE-2015-8562-PHP-POC http://packetstormsecurity.com/files/134949/Joomla-HTTP-Header-Unauthenticated-Remote-Code-Execution.html http://packetstormsecurity.com/files/135100/Joomla-3.4.5-Object-Injection.html http://ww • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 28EXPL: 0CVE-2012-0819
https://notcve.org/view.php?id=CVE-2012-0819
Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0821. Vulnerabilidad no especificada en Joomla! v1.6.x y v1.7.x anterior a v1.7.4 permite a atacantes remotos obtener información sensible a través de vectores desconocidos, una vulnerabilidad diferente a CVE-2012-0821. • http://developer.joomla.org/security/news/382-20120101-core-information-disclosure http://secunia.com/advisories/47753 http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html http://www.openwall.com/lists/oss-security/2012/01/25/1 http://www.openwall.com/lists/oss-security/2012/01/26/2 http://www.openwall.com/lists/oss-security/2012/01/26/4 http://www.openwall.com/lists/os •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2012-0820
https://notcve.org/view.php?id=CVE-2012-0820
Cross-site scripting (XSS) vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0822. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Joomla! v1.6.x y v1.7.x anterior a v1.7.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados, una vulnerabilidad diferente a CVE-2012-0822 • http://developer.joomla.org/security/news/383-20120102-core-xss-vulnerability http://secunia.com/advisories/47753 http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html http://www.openwall.com/lists/oss-security/2012/01/25/1 http://www.openwall.com/lists/oss-security/2012/01/26/2 http://www.openwall.com/lists/oss-security/2012/01/26/4 http://www.openwall.com/lists/oss- • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 28EXPL: 0CVE-2012-0821
https://notcve.org/view.php?id=CVE-2012-0821
Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0819. Vulnerabilidad no especificada en Joomla! v1.6.x y v1.7.x anterior a v1.7.4 permite a atacantes remotos obtener información sensible a través de vectores desconocidos, una vulnerabilidad diferente a CVE-2012-0819. • http://developer.joomla.org/security/news/384-20120103-core-information-disclosure http://secunia.com/advisories/47753 http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html http://www.openwall.com/lists/oss-security/2012/01/25/1 http://www.openwall.com/lists/oss-security/2012/01/26/2 http://www.openwall.com/lists/oss-security/2012/01/26/4 http://www.openwall.com/lists/os •