CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2010-1649
https://notcve.org/view.php?id=CVE-2010-1649
Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in administrator/index.php. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados(XSS) en el backend de Joomla! v1.5 a v1.5.17 permiten a atacantes remotos inyectar HTML o secuencias de comandos web a través de vectores desconocidos relacionados con "varias pantallas de administrador". Posiblemente se trate del parámetro de búsqueda en administrator/index.php. • http://developer.joomla.org/security/news/314-20100501-core-xss-vulnerabilities-in-back-end.html?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+JoomlaSecurityNews+%28Joomla%21+Security+News%29 http://secunia.com/advisories/39964 http://www.osvdb.org/65011 http://www.securityfocus.com/bid/40444 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2010-1721 – Joomla! Component Intellectual Property 1.5.3 - 'id' SQL Injection
https://notcve.org/view.php?id=CVE-2010-1721
SQL injection vulnerability in the Intellectual Property (aka IProperty or com_iproperty) component 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an agentproperties action to index.php. Vulnerabilidad de inyección SQL en el componente Intellectual Property (también conocido como IProperty or com_iproperty) para Joomla!, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro id en una acción agentproperties en index.php • https://www.exploit-db.com/exploits/12246 http://extensions.thethinkery.net http://osvdb.org/63750 http://secunia.com/advisories/39427 http://www.exploit-db.com/exploits/12246 http://www.securityfocus.com/bid/39495 https://exchange.xforce.ibmcloud.com/vulnerabilities/57875 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 1%CPEs: 6EXPL: 4CVE-2010-1312 – Joomla! Component News Portal 1.5.x - Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-1312
Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. Una Vulnerabilidad del salto del directorio en el componente iJoomla News Portal (com_news_portal) versión 1.5.x para Joomla! permite a los atacantes remotos leer archivos arbitrarios por medio de un .. • https://www.exploit-db.com/exploits/12077 http://osvdb.org/63572 http://packetstormsecurity.org/1004-exploits/joomlanewportal-lfi.txt http://secunia.com/advisories/39289 http://www.exploit-db.com/exploits/12077 http://www.securityfocus.com/bid/39222 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2010-0635
https://notcve.org/view.php?id=CVE-2010-0635
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information. Vulnerabilidad de inyección SQL en el método plgSearchEventsearch::onSearch en eventsearch.php en el plugin JEvents Search v1.5 a la v1.5.3 para Joomla!, permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores sin especificar. • http://secunia.com/advisories/38404 http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526 http://www.securityfocus.com/bid/38050 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 3CVE-2009-4550 – Joomla! Component Kunena Forums (com_kunena) - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-4550
SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php. Vulnerabilidad de inyección SQL en el componente Kunena Forum (com_kunena) v1.5.3 y v1.5.4 para Joomla! permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "func" a index.php. • https://www.exploit-db.com/exploits/9408 http://secunia.com/advisories/36245 http://www.exploit-db.com/exploits/9408 http://www.securityfocus.com/bid/36020 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •