CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 4CVE-2010-0610 – Joomla! Component com_photoblog - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2010-0610
11 Feb 2010 — Multiple SQL injection vulnerabilities in the Photoblog (com_photoblog) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the blog parameter in an images action to index.php. NOTE: a separate vector for the id parameter to detail.php may also exist. El componente Photoblog (com_photoblog) para Joomla! permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "blog" en una acción images al index.php. • https://www.exploit-db.com/exploits/11337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 15EXPL: 0CVE-2009-3945
https://notcve.org/view.php?id=CVE-2009-3945
16 Nov 2009 — Unspecified vulnerability in the Front-End Editor in the com_content component in Joomla! before 1.5.15 allows remote authenticated users, with Author privileges, to replace the articles of an arbitrary user via unknown vectors. Vulnerabilidad no especificada en el Front-End Editor del componente com_content en Joomla! versiones anteriores a v1.5.15 permite a usuarios autenticados remotamente, con privilegios "Author", reemplazar los artículos de un usuario de su elección mediante vectores desconocidos. • http://developer.joomla.org/security/news/305-20091103-core-front-end-editor-issue-.html •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2009-3946
https://notcve.org/view.php?id=CVE-2009-3946
16 Nov 2009 — Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request. Joomla! versiones anteriores a v1.5.15 permite a atacantes remotos leer el fichero XML de una extensión, y de ese modo obtener el número de versión de la extensión, mediante una petición directa. • http://developer.joomla.org/security/news/306-20091103-core-xml-file-read-issue.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2008-4122
https://notcve.org/view.php?id=CVE-2008-4122
19 Dec 2008 — Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. Joomla! 1.5.8 no habilita el flag 'secure' para la cookie de la sesión en una sesión https, lo faciita a los atacantes remotos el capturar esta cookie interceptando su transmisión dentro de una sesión http. • http://int21.de/cve/CVE-2008-4122-joomla.html • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4650
https://notcve.org/view.php?id=CVE-2005-4650
31 Dec 2005 — Joomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumption) via a large number of Search Mambots. • http://secunia.com/advisories/17675 • CWE-770: Allocation of Resources Without Limits or Throttling •