CVSS: 8.8EPSS: 0%CPEs: 180EXPL: 0CVE-2017-11364
https://notcve.org/view.php?id=CVE-2017-11364
The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs. El instalador CMS en versiones anteriores a la 3.7.4 de Joomla! no verifica la propiedad de un usuario en un espacio web, lo que permite que usuarios remotos autenticados consigan control sobre la aplicación objetivo, haciendo uso de los logs del estándar Certificate Transparency. • http://www.securitytracker.com/id/1039015 https://developer.joomla.org/security-centre/700-20170704-core-installer-lack-of-ownership-verification.html https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Hanno-Boeck-Abusing-Certificate-Transparency-Logs.pdf https://twitter.com/hanno/status/890281330906247168 • CWE-295: Improper Certificate Validation •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2012-6503
https://notcve.org/view.php?id=CVE-2012-6503
Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors. Vulnerabilidad no especificada en el componente NinjaXplorer anterior a v1.0.7 para Joomla! tiene un impacto desconocido y vectores de ataque. • http://ninjaforge.com/blog/318-security-vulnerability-discovered-in-ninjaxplorer-upgrade-immediately http://secunia.com/advisories/48958 http://www.osvdb.org/81630 http://www.securityfocus.com/bid/53256 https://exchange.xforce.ibmcloud.com/vulnerabilities/75161 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2010-5056 – Joomla! Component GBU Facebook 1.0.5 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-5056
SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the face_id parameter in a show_face action to index.php. Vulnerabilidad de inyección SQL en el componente GBU Facebook (com_gbufacebook) v1.0.5 para Joomla! permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro face_id. una acción show_face de index.php • https://www.exploit-db.com/exploits/12299 http://packetstormsecurity.org/1004-exploits/joomlagbufacebook-sql.txt http://secunia.com/advisories/39487 http://www.exploit-db.com/exploits/12299 http://www.securityfocus.com/bid/39576 http://www.vupen.com/english/advisories/2010/0944 https://exchange.xforce.ibmcloud.com/vulnerabilities/57946 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 5CVE-2010-2513 – Joomla! Component JE Ajax Event Calendar - SQL Injection
https://notcve.org/view.php?id=CVE-2010-2513
SQL injection vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php. Vulnerabilidad de inyección SQL en el componente JE Ajax Event Calendar (com_jeajaxeventcalendar) v1.0.5 para Joomla!, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro view sobre index.php • https://www.exploit-db.com/exploits/15610 https://www.exploit-db.com/exploits/13997 http://packetstormsecurity.org/1006-exploits/joomlajeajax-sql.txt http://www.exploit-db.com/exploits/13997 http://www.securityfocus.com/bid/41058 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 14EXPL: 4CVE-2010-1531 – Joomla! Component redSHOP 1.0 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-1531
Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. Vulnerabilidad de salto de directorio en el componente redSHOP (com_redshop) v1.0.x para Joomla! permite a atacantes remotos leer archivos de su elección a través de .. • https://www.exploit-db.com/exploits/12054 http://packetstormsecurity.org/1004-exploits/joomlaredshop-lfi.txt http://redcomponent.com/redshop/redshop-changelog http://secunia.com/advisories/39343 http://www.exploit-db.com/exploits/12054 http://www.osvdb.org/63535 http://www.securityfocus.com/bid/39206 https://exchange.xforce.ibmcloud.com/vulnerabilities/57512 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •