Page 5 of 65 results (0.004 seconds)

CVSS: 9.8EPSS: 3%CPEs: 119EXPL: 1

CVE-2017-14596

https://notcve.org/view.php?id=CVE-2017-14596

20 Sep 2017 — In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password. En Joomla! en versiones anteriores a la 3.8.0, un escape inadecuado en el plugin de autenticación LDAP puede resultar en una divulgación del nombre de usuario y la contraseña. • http://www.securityfocus.com/bid/100898 • CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') •

CVSS: 8.8EPSS: 0%CPEs: 180EXPL: 0

CVE-2017-11364

https://notcve.org/view.php?id=CVE-2017-11364

02 Aug 2017 — The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs. El instalador CMS en versiones anteriores a la 3.7.4 de Joomla! no verifica la propiedad de un usuario en un espacio web, lo que permite que usuarios remotos autenticados consigan control sobre la aplicación objetivo, haciendo uso de los logs del estándar Certificate Transparency. • http://www.securitytracker.com/id/1039015 • CWE-295: Improper Certificate Validation •

CVSS: 6.1EPSS: 0%CPEs: 160EXPL: 0

CVE-2017-11612

https://notcve.org/view.php?id=CVE-2017-11612

26 Jul 2017 — In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components. En Joomla! en versiones anteriores a la 3.7.4, el filtrado inadecuado de etiquetas HTML potencialmente maliciosas conduce a vulnerabilidades XSS en varios componentes. • http://www.securitytracker.com/id/1039014 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 114EXPL: 0

CVE-2017-9933

https://notcve.org/view.php?id=CVE-2017-9933

17 Jul 2017 — Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents. Invalidación del cache inapropiada en Joomla! CMS 1.7.3 hasta la 3.7.2 que lleva a una revelación de los contenidos • http://www.securityfocus.com/bid/99450 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 103EXPL: 1

CVE-2017-9934

https://notcve.org/view.php?id=CVE-2017-9934

17 Jul 2017 — Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability. Perdidos tokens CSRF verificados y validación inapropiada de la entrada en Joomla! CMS 1.7.3 hasta la 3.7.2 que lleva a una vulnerabilidad XSS. • https://github.com/xyringe/CVE-2017-9934 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 137EXPL: 0

CVE-2017-7983

https://notcve.org/view.php?id=CVE-2017-7983

25 Apr 2017 — In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers. Al enviar un email utilizando JMail API, en Joomla! 1.5.0 hasta 3.6.5, se divulga en la cabecera del email la versión de PHPMailer utilizada. El fallo ha sido corregido en la versión 3.7.0. • http://www.securityfocus.com/bid/98016 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.3EPSS: 0%CPEs: 120EXPL: 0

CVE-2017-7988

https://notcve.org/view.php?id=CVE-2017-7988

25 Apr 2017 — In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article. El filtrado inadecuado del contenido de los formularios en Joomla! 1.6.0 hasta 3.6.5 permite la sobreescritura del autor de un artículo. El fallo se ha corregido en la versión 3.7.0. • http://www.securityfocus.com/bid/98022 •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-7985

https://notcve.org/view.php?id=CVE-2017-7985

25 Apr 2017 — In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components. El filtrado inadecuado de caracteres multibyte, en Joomla 1.5.0 hasta 3.6.5, puede derivar en vulnerabilidades XSS en varios componentes. El fallo se ha corregido en la versión 3.7.0. • http://www.securityfocus.com/bid/98020 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 137EXPL: 0

CVE-2017-7986

https://notcve.org/view.php?id=CVE-2017-7986

25 Apr 2017 — In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components. Un unadecuado sistema de filtrado de atributos HTML en Joomla! 1.5.0 hasta 3.6.5 permite realizar un ataque de cross-site scripting en varios componentes. • http://www.securityfocus.com/bid/98024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 93%CPEs: 3EXPL: 11

CVE-2016-10045 – PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution

https://notcve.org/view.php?id=CVE-2016-10045

28 Dec 2016 — The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. El transporte isMail en PHPMailer en versiones anteriores a 5.2.20 podrían permitir a atacantes remotos pasar parámetros extra al comando ... • https://packetstorm.news/files/id/140286 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •