CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 2CVE-2012-2413 – Joomla 1.5.26 ja_purity Cross Site Scripting
https://notcve.org/view.php?id=CVE-2012-2413
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php. Vulnerabilidad de XSS en la plantilla ja_purity para Joomla! 1.5.26 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro Mod* cookie en html/modules.php. Joomla version 1.5.26 suffers from a cross site scripting vulnerability in the ja_purity template. • http://archives.neohapsis.com/archives/bugtraq/2012-05/0021.html http://www.securityfocus.com/bid/53382 http://www.waraxe.us/advisory-87.html https://exchange.xforce.ibmcloud.com/vulnerabilities/75398 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 26EXPL: 0CVE-2011-4321
https://notcve.org/view.php?id=CVE-2011-4321
The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors. La funcionalidad de reinicialización de contraseña en Joomla! v1.5.x hasta v1.5.24 utiliza números aleatorios débiles, lo que hace más sencillo para atacantes remotos cambiar las contraseñas de usuarios de su elección a través de vectores no especificados. • http://developer.joomla.org/security/news/9-security/10-core-security/375-20111103-core-password-change http://www.openwall.com/lists/oss-security/2011/11/21/1 • CWE-310: Cryptographic Issues •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 4CVE-2010-4838 – Joomla! Component JSupport 1.5.6 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-4838
SQL injection vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote authenticated users, with Public Back-end permissions, to execute arbitrary SQL commands via the alpha parameter in a (1) listTickets or (2) listFaqs action to administrator/index.php. Una vulnerabilidad de inyección SQL en el componente JSupport (com_jsupport) v1.5.6 para Joomla! permite ejecutar comandos SQL a usuarios remotos autenticados, con permisos de back-end publicos, a través del parámetro alpha en una accion (1) listTickets o (2) listFaqs en administrator/index.php. • https://www.exploit-db.com/exploits/15502 http://packetstormsecurity.org/files/view/95797/joomlajsupport-sql.txt http://secunia.com/advisories/42262 http://securityreason.com/securityalert/8379 http://www.exploit-db.com/exploits/15502 http://www.xenuser.org/documents/security/Joomla_com_jsupport_SQLi.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 3%CPEs: 2EXPL: 4CVE-2010-4837 – Joomla! Component JSupport 1.5.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-4837
Cross-site scripting (XSS) vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the subject parameter (title field) in a saveTicket action to index2.php. NOTE: some of these details are obtained from third party information. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el componente JSupport (com_jsupport) v1.5.6 para Joomla! permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro subject (campo de título) en una acción saveTicket a index2.php. • https://www.exploit-db.com/exploits/15501 http://packetstormsecurity.org/files/view/95796/joomlajsupport-xss.txt http://secunia.com/advisories/42262 http://securityreason.com/securityalert/8377 http://www.exploit-db.com/exploits/15501 http://www.xenuser.org/documents/security/Joomla_com_jsupport_XSS.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 49EXPL: 2CVE-2011-2710
https://notcve.org/view.php?id=CVE-2011-2710
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component. NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Joomla! before v1.7.0, permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de(1) la URI sobre includes/application.php, accesible desde index.php; y, cuando de usa Internet Explorer o Konqueror, (2) permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro searchword en una acción search sobre index.php en el componente com_search. • http://developer.joomla.org/security/news/357-20110701-xss-vulnerability.html http://www.openwall.com/lists/oss-security/2011/07/22/1 http://www.openwall.com/lists/oss-security/2011/07/22/5 http://www.openwall.com/lists/oss-security/2011/10/16/1 http://www.openwall.com/lists/oss-security/2011/11/21/27 http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-rc%5D_cross_site_scripting%28XSS%29 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •