CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2011-3747
https://notcve.org/view.php?id=CVE-2011-3747
Joomla! 1.6.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by libraries/phpmailer/language/phpmailer.lang-joomla.php. Joomla! v1.6.0 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con libraries/phpmailer/language/phpmailer.lang-joomla.php. • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/joomla-1.6.0 http://www.openwall.com/lists/oss-security/2011/06/27/6 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 4CVE-2010-4838 – Joomla! Component JSupport 1.5.6 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-4838
SQL injection vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote authenticated users, with Public Back-end permissions, to execute arbitrary SQL commands via the alpha parameter in a (1) listTickets or (2) listFaqs action to administrator/index.php. Una vulnerabilidad de inyección SQL en el componente JSupport (com_jsupport) v1.5.6 para Joomla! permite ejecutar comandos SQL a usuarios remotos autenticados, con permisos de back-end publicos, a través del parámetro alpha en una accion (1) listTickets o (2) listFaqs en administrator/index.php. • https://www.exploit-db.com/exploits/15502 http://packetstormsecurity.org/files/view/95797/joomlajsupport-sql.txt http://secunia.com/advisories/42262 http://securityreason.com/securityalert/8379 http://www.exploit-db.com/exploits/15502 http://www.xenuser.org/documents/security/Joomla_com_jsupport_SQLi.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 3%CPEs: 2EXPL: 4CVE-2010-4837 – Joomla! Component JSupport 1.5.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-4837
Cross-site scripting (XSS) vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the subject parameter (title field) in a saveTicket action to index2.php. NOTE: some of these details are obtained from third party information. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el componente JSupport (com_jsupport) v1.5.6 para Joomla! permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro subject (campo de título) en una acción saveTicket a index2.php. • https://www.exploit-db.com/exploits/15501 http://packetstormsecurity.org/files/view/95796/joomlajsupport-xss.txt http://secunia.com/advisories/42262 http://securityreason.com/securityalert/8377 http://www.exploit-db.com/exploits/15501 http://www.xenuser.org/documents/security/Joomla_com_jsupport_XSS.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 1CVE-2011-2892
https://notcve.org/view.php?id=CVE-2011-2892
Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. Joomla! v1.6.x anteriores a v1.6.2 no impide la renderización de páginas dentro de un marco en un documento HTML de terceros, lo que hace facilita a los atacantes remotos el realizar ataques de clickjacking mediante un sitio web manipulado. • http://bl0g.yehg.net/2011/04/joomla-161-and-lower-information.html http://developer.joomla.org/security/news/347-20110409-core-clickjacking.html • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 49EXPL: 2CVE-2011-2710
https://notcve.org/view.php?id=CVE-2011-2710
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component. NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Joomla! before v1.7.0, permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de(1) la URI sobre includes/application.php, accesible desde index.php; y, cuando de usa Internet Explorer o Konqueror, (2) permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro searchword en una acción search sobre index.php en el componente com_search. • http://developer.joomla.org/security/news/357-20110701-xss-vulnerability.html http://www.openwall.com/lists/oss-security/2011/07/22/1 http://www.openwall.com/lists/oss-security/2011/07/22/5 http://www.openwall.com/lists/oss-security/2011/10/16/1 http://www.openwall.com/lists/oss-security/2011/11/21/27 http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-rc%5D_cross_site_scripting%28XSS%29 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •