CVSS: 3.5EPSS: 0%CPEs: 21EXPL: 0CVE-2010-2535
https://notcve.org/view.php?id=CVE-2010-2535
Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 allow remote authenticated users to inject arbitrary web script or HTML via administrator screens. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en el Back End en Joomla! v1.5.x anterior a 1.5.20, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML de su elección a través de las pantallas de administración. • http://developer.joomla.org/security/news/318-20100704-core-xss-vulnerabilitis-in-back-end.html http://www.ocert.org/advisories/ocert-2010-002.html http://www.openwall.com/lists/oss-security/2010/07/20/2 http://www.openwall.com/lists/oss-security/2010/07/21/8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2010-3422 – Joomla! Component JGen 0.9.33 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-3422
SQL injection vulnerability in the JGen (com_jgen) component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php. Vulnerabilidad de inyección SQL en el componente JGen (com_jgen) v0.9.33 para Joomla! permite a atacantes remotos ejecutar comandos SQL a través del parámetro id en una acción view a index.php. • https://www.exploit-db.com/exploits/14998 http://www.exploit-db.com/exploits/14998 http://www.securityfocus.com/bid/43210 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 4CVE-2010-3426 – Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-3426
Directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. Vulnerabilidad de salto de directorio en jphone.php en el componente JPhone (com_jphone) v1.0 Alpha 3 para Joomla! permite a atacantes remotos incluir y ejecutar archivos locales a su elección a través de un .. • https://www.exploit-db.com/exploits/14964 http://packetstormsecurity.org/1009-exploits/joomlajphone-lfi.txt http://www.exploit-db.com/exploits/14964 http://www.securityfocus.com/bid/43147 https://exchange.xforce.ibmcloud.com/vulnerabilities/61723 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 2CVE-2010-3203 – Joomla! Component PicSell 1.0 - Local File Disclosure
https://notcve.org/view.php?id=CVE-2010-3203
Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dflink parameter in a prevsell dwnfree action to index.php. Vulnerabilidad de salto de directorio en el componente PicSell (com_picsell) v1.0 para Joomla! permite a atacantes remotos leer archivos de su elección a través de los caracteres .. • https://www.exploit-db.com/exploits/14845 http://secunia.com/advisories/41187 http://www.exploit-db.com/exploits/14845 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2010-3211 – Joomla! Component JE FAQ Pro 1.5.0 - Multiple Blind SQL Injections
https://notcve.org/view.php?id=CVE-2010-3211
Multiple SQL injection vulnerabilities in the JE FAQ Pro (com_jefaqpro) component 1.5.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via category categorylist operations with (1) the catid parameter or (2) the catid parameter in a lists action. Múltiples vulnerabilidades de inyección SQL en el componente JE FAQ Pro (com_jefaqpro) v1.5.0 para Joomla! permite a atacantes remotos ejecutar comandos SQL de su elección a través de operaciones categorylist con el parámetro (1) catid o (2) o el parámetro catid en una acción lists. • https://www.exploit-db.com/exploits/14846 http://secunia.com/advisories/41078 http://www.exploit-db.com/exploits/14846 https://exchange.xforce.ibmcloud.com/vulnerabilities/61485 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •