4 results (0.007 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-7742

https://notcve.org/view.php?id=CVE-2019-7742

12 Feb 2019 — An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector. Se ha descubierto un problema en versiones anteriores a la 3.9.3 de Joomla!. Una combinación de configuraciones específicas del servidor web, junto con tipos de archivo concretos y el rastreo de tipo MIME del lado del servidor, provoca un vector de ataque XSS. • https://developer.joomla.org/security-centre/766-20190202-core-browserside-mime-type-sniffing-causes-xss-attack-vectors • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 180EXPL: 0

CVE-2017-11364

https://notcve.org/view.php?id=CVE-2017-11364

02 Aug 2017 — The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs. El instalador CMS en versiones anteriores a la 3.7.4 de Joomla! no verifica la propiedad de un usuario en un espacio web, lo que permite que usuarios remotos autenticados consigan control sobre la aplicación objetivo, haciendo uso de los logs del estándar Certificate Transparency. • http://www.securitytracker.com/id/1039015 • CWE-295: Improper Certificate Validation •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 3

CVE-2011-0005 – Joomla! 1.0.x - 'ordering' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2011-0005

11 Jan 2011 — Cross-site scripting (XSS) vulnerability in the com_search module for Joomla! 1.0.x through 1.0.15 allows remote attackers to inject arbitrary web script or HTML via the ordering parameter to index.php. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo com_search de Joomla! 1.0.x hasta la 1.0.15. Permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través del parámetro ordering de index.php. • https://www.exploit-db.com/exploits/35167 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 4

CVE-2010-2682 – Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion

https://notcve.org/view.php?id=CVE-2010-2682

09 Jul 2010 — Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. Vulnerabilidad de salto de directorio en el componente Realtyna Translator (com_realtyna) v1.0.15 para Joomla!, permite a atacantes remotos leer ficheros arbitrarios y tener posiblemente otro tipo de impacto no especificado al utilizar caracteres .. • https://www.exploit-db.com/exploits/14017 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •