Page 7 of 71 results (0.011 seconds)

CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0

CVE-2013-3267

https://notcve.org/view.php?id=CVE-2013-3267

03 May 2013 — Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el plugin highlighter en Joomla! v2.5.x anterior a v2.5.10 y v3.0.x anterior a v3.0.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.1EPSS: 0%CPEs: 14EXPL: 0

CVE-2013-3057

https://notcve.org/view.php?id=CVE-2013-3057

03 May 2013 — Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors. Joomla! v2.5.x anterior a v2.5.10 y v3.0.x anterior a v3.0.4 permite a usuarios autenticados remotos eludir los requerimientos de privilegio y listar los privilegios de usuarios de su elección mediante vectores desconocidos. • http://developer.joomla.org/security/82-20130402-core-information-disclosure.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 0

CVE-2013-3056

https://notcve.org/view.php?id=CVE-2013-3056

03 May 2013 — Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors. Joomla! v2.5.x anterior a v2.5.10 y v3.0.x anterior a v3.0.4 permite a usuarios autenticados remotos eludir los requerimientos de privilegio y eliminar mensajes privados de usuarios de su elección mediante vectores desconocidos. • http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.1EPSS: 0%CPEs: 14EXPL: 3

CVE-2013-3242 – Joomla! 3.0.3 - 'remember.php' PHP Object Injection

https://notcve.org/view.php?id=CVE-2013-3242

03 May 2013 — plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors. plugins/system/remember/remember.php en Joomla! v2.5.x anterior a v2.5.10 y v3.0.x anterior a v3.0.4 no controla correctamente un objeto obtenido por la "serialización" de una cookie, lo que permite a los usuarios r... • https://www.exploit-db.com/exploits/25087 • CWE-20: Improper Input Validation •

CVSS: 9.1EPSS: 0%CPEs: 12EXPL: 2

CVE-2013-1453 – Joomla! 3.0.2 - 'highlight.php' PHP Object Injection

https://notcve.org/view.php?id=CVE-2013-1453

13 Feb 2013 — plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information, but later analysis demonstrated that other attacks exist. El archivo plugins/system/highlight/highlight.... • https://www.exploit-db.com/exploits/24551 •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2012-5827

https://notcve.org/view.php?id=CVE-2012-5827

11 Nov 2012 — Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving "Inadequate protection." Joomla! versiones 2.5.x anteriores a 2.5.8 y versiones 3.0.x anteriores a 3.0.2, permite a los atacantes remotos conducir ataques de secuestro de cliqueo por medio de vectores no especificados que implican "Inadequate protection". • http://developer.joomla.org/security/news/543-20121101-core-clickjacking.html •

CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0

CVE-2012-4531

https://notcve.org/view.php?id=CVE-2012-4531

31 Oct 2012 — Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Joomla! v2.5.x antes de v2.5.7, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especifidados. • http://developer.joomla.org/security/news/539-20120901-core-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 1

CVE-2012-4532

https://notcve.org/view.php?id=CVE-2012-4532

31 Oct 2012 — Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are obtained from third party information. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en modules/mod_languages/tmpl/default.php en el módulo Language Switcher para Joomla! v2.5.x antes de v2.5.7, permite a a... • http://developer.joomla.org/security/news/540-20120902-core-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 108EXPL: 0

CVE-2012-4071

https://notcve.org/view.php?id=CVE-2012-4071

10 Aug 2012 — Cross-site scripting (XSS) vulnerability in the comments module in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to inject arbitrary web script or HTML via crafted BBCode markup in a comment. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo RSGallery2 (com_rsgallery2) anterior a v2.3.0 para Joomla! v1.5.x, y anteriores a v3.2.0 para Joomla! • http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/142 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 44EXPL: 0

CVE-2012-4235

https://notcve.org/view.php?id=CVE-2012-4235

10 Aug 2012 — The RSGallery2 (com_rsgallery2) component before 3.2.0 for Joomla! 2.5.x does not place index.html files in image directories, which allows remote attackers to list image filenames via a request for a directory URI. El componente The RSGallery2 (com_rsgallery2) anterior a v3.2.0 para Joomla! v2.5.x no coloca archivos index.html en los directorios de imágenes, lo que permite a atacantes remotos enumerar nombres de fichero de imagen a través de una petición de un URI del directorio. • http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/142 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •