CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 0CVE-2009-3946
https://notcve.org/view.php?id=CVE-2009-3946
Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request. Joomla! versiones anteriores a v1.5.15 permite a atacantes remotos leer el fichero XML de una extensión, y de ese modo obtener el número de versión de la extensión, mediante una petición directa. • http://developer.joomla.org/security/news/306-20091103-core-xml-file-read-issue.html http://secunia.com/advisories/37262 http://www.osvdb.org/59800 https://exchange.xforce.ibmcloud.com/vulnerabilities/54160 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2008-4122
https://notcve.org/view.php?id=CVE-2008-4122
Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. Joomla! 1.5.8 no habilita el flag 'secure' para la cookie de la sesión en una sesión https, lo faciita a los atacantes remotos el capturar esta cookie interceptando su transmisión dentro de una sesión http. • http://int21.de/cve/CVE-2008-4122-joomla.html http://securityreason.com/securityalert/4794 http://www.securityfocus.com/archive/1/499295/100/0/threaded http://www.securityfocus.com/archive/1/499354/100/0/threaded • CWE-319: Cleartext Transmission of Sensitive Information •