CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 2CVE-2010-4166
https://notcve.org/view.php?id=CVE-2010-4166
Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via (1) the filter_order parameter in a com_weblinks category action to index.php, (2) the filter_order_Dir parameter in a com_weblinks category action to index.php, or (3) the filter_order_Dir parameter in a com_messages action to administrator/index.php. Múltiples vulnerabilidades de inyección SQL en Joomla! v1.5.x anterior a v1.5.22 permite a atacantes remotos ejecutar comandos SQL a través de (1) el parámetro filter_order en una acción de categoría com_weblinks a index.php, (2) el parámetro filter_order_Dir en una acción de categoría com_weblinks a index.php, o (3) el parámetro filter_order_Dir en una acción com_messages a administrator/index.php. • http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0514.html http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html http://openwall.com/lists/oss-security/2010/11/12/5 http://openwall.com/lists/oss-security/2010/11/12/6 http://secunia.com/advisories/42133 http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_%28filter_order%29_front.jpg http://yehg.net/lab/pr0js/advisories&#x • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2010-4696
https://notcve.org/view.php?id=CVE-2010-4696
Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via the (1) filter_order or (2) filter_order_Dir parameter in a com_contact action to index.php, a different vulnerability than CVE-2010-4166. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de inyección SQL en Joomla! v1.5.x anterior a v1.5.22 permite a atacantes remotos ejecutar comandos SQL a través de los parámetros (1) filter_order o (2) filter_order_Dir en una acción com_contact a index.php, una vulnerabilidad diferente de CVE-2010-4166. • http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html http://openwall.com/lists/oss-security/2010/11/12/5 http://openwall.com/lists/oss-security/2010/11/12/6 http://secunia.com/advisories/42133 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 22EXPL: 0CVE-2010-3712
https://notcve.org/view.php?id=CVE-2010-3712
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving "multiple encoded entities," as demonstrated by the query string to index.php in the com_weblinks or com_content component. Vulnerabilidad de tipo cross-site scripting (XSS) en Joomla!, versiones 1.5.x anteriores a 1.5.21 y versiones 1.6.x anteriores a 1.6.1, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio de vectores que implican "multiple encoded entities", como es demostrado por la cadena de consulta a el archivo index.php en el componente com_weblinks o com_content. • http://developer.joomla.org/security/news/9-security/10-core-security/322-20101001-core-xss-vulnerabilities http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_id=32&tracker_item_id=22767 http://www.openwall.com/lists/oss-security/2010/10/08/4 http://www.openwall.com/lists/oss-security/2010/10/11/4 http://www.openwall.com/lists/oss-security/2011/03/13/8 http://www.openwall.com/lists/oss-security/2011/03/14/22 http://www.openwall.com/lists& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 21EXPL: 0CVE-2010-2535
https://notcve.org/view.php?id=CVE-2010-2535
Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 allow remote authenticated users to inject arbitrary web script or HTML via administrator screens. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en el Back End en Joomla! v1.5.x anterior a 1.5.20, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML de su elección a través de las pantallas de administración. • http://developer.joomla.org/security/news/318-20100704-core-xss-vulnerabilitis-in-back-end.html http://www.ocert.org/advisories/ocert-2010-002.html http://www.openwall.com/lists/oss-security/2010/07/20/2 http://www.openwall.com/lists/oss-security/2010/07/21/8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2010-1522
https://notcve.org/view.php?id=CVE-2010-1522
Multiple SQL injection vulnerabilities in the BookLibrary Basic (com_booklibrary) component 1.5.3 before 1.5.3_2010_06_20 for Joomla! allow remote attackers to execute arbitrary SQL commands via the bid[] parameter in a (1) lend_request or (2) save_lend_request action to index.php, the id parameter in a (3) mdownload or (4) downitsf action to index.php, or (5) the searchtext parameter in a search action to index.php. Múltiples vulnerabilidades de inyección SQL en el componente BookLibrary Basic (com_booklibrary) v1.5.3 anterior a v1.5.3_2010_06_20 para Joomla! permiten a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro bid[] en una acción (1) lend_request o (2) save_lend_request en index.php; el parámetro id en una acción (3) mdownload o (4) downitsf en index.php; o (5) el parámetro searchtext en una acción search en index.php. • http://ordasoft.com/Download/Download-document/3-BookLibrary-1.5.3-Basic-for-Joomla-1.5.html http://ordasoft.com/Download/View-document-details/3-BookLibrary-1.5.3-Basic-for-Joomla-1.5.html http://osvdb.org/65879 http://secunia.com/advisories/40131 http://secunia.com/secunia_research/2010-84 http://www.securityfocus.com/archive/1/512094/100/0/threaded http://www.securityfocus.com/bid/41264 https://exchange.xforce.ibmcloud.com/vulnerabilities/59966 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •