CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2010-2035 – Joomla! Component Percha Gallery 1.6 Beta - 'Controller' Traversal Arbitrary File Access
https://notcve.org/view.php?id=CVE-2010-2035
Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. Vulnerabilidad de salto de directorio en el componente Percha Gallery (com_perchagallery) v1.6 Beta de Joomla!. Permite a atacantes remotos leer ficheros de su elección y, posiblemente, tener otro impacto a través de un .. • https://www.exploit-db.com/exploits/34006 http://packetstormsecurity.org/1005-exploits/joomlaperchagl-lfi.txt http://www.securityfocus.com/bid/40244 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 0CVE-2008-6276
https://notcve.org/view.php?id=CVE-2008-6276
Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via (1) a content type or (2) a voting API value. Múltiples vulnerabilidades de inyección SQL en el módulo User Karma v5.x anterior a v5.x-1.13 y v6.x anterior a v6.x-1.0-beta1 para Drupal, permite a administradores autenticados remotamente ejecutar comandos SQL de su elección a través de (1) un tipo de contenido o (2) un valor "voting API". • http://drupal.org/node/339553 http://osvdb.org/50207 http://secunia.com/advisories/32904 http://www.securityfocus.com/bid/32491 https://exchange.xforce.ibmcloud.com/vulnerabilities/46946 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2008-6275
https://notcve.org/view.php?id=CVE-2008-6275
Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified messages. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo User Karma v5.x anterior a v5.x-1.13 y v6.x anterior a v6.x-1.0-beta1 para Drupal, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de mensajes no especificados. • http://drupal.org/node/339553 http://osvdb.org/50208 http://secunia.com/advisories/32904 http://www.securityfocus.com/bid/32491 https://exchange.xforce.ibmcloud.com/vulnerabilities/46947 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 2CVE-2009-0421 – Joomla! Component com_Eventing 1.6.x - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-0421
SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. Vulnerabilidad de inyección SQL en el componente para Joomla! Eventing (com_eventing) v1.6.x; permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro catid de index.php. • https://www.exploit-db.com/exploits/7793 http://secunia.com/advisories/33563 http://www.securityfocus.com/bid/33296 https://exchange.xforce.ibmcloud.com/vulnerabilities/48016 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 2CVE-2008-5208 – Joomla! Component Datsogallery 1.6 - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2008-5208
SQL injection vulnerability in sub_votepic.php in the Datsogallery (com_datsogallery) module 1.6 for Joomla! allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header. Vulnerabilidad de inyección SQL en sub_votepic.php en el módulo Datsogallery (com_datsogallery) v1.6 para Joomla! permite a atacantes remotos ejecutar comandos SQL de su elección utilizando la cabecera HTTP "User-Agent". • https://www.exploit-db.com/exploits/5583 http://secunia.com/advisories/30139 http://securityreason.com/securityalert/4624 http://www.securityfocus.com/bid/29138 https://exchange.xforce.ibmcloud.com/vulnerabilities/42324 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •