CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Joomla : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complex ity Authen tication Confiden tiality Integrity Availa bility
1 CVE-2011-4332 79 XSS 2011-11-23 2011-11-28
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2 CVE-2011-4321 310 2011-11-23 2011-11-28
5.0
 None Remote Low Not required None Partial None
The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors.
3 CVE-2011-3747 200 +Info 2011-09-23 2012-03-12
5.0
 None Remote Low Not required Partial None None
Joomla! 1.6.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by libraries/phpmailer/language/phpmailer.lang-joomla.php.
4 CVE-2011-2892 20 2011-07-27 2011-07-29
4.3
 None Remote Medium Not required None Partial None
Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
5 CVE-2011-2891 200 +Info 2011-07-27 2011-08-10
5.0
 None Remote Low Not required Partial None None
Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.
6 CVE-2011-2890 200 +Info 2011-07-27 2011-08-10
5.0
 None Remote Low Not required Partial None None
The MediaViewMedia class in administrator/components/com_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attackers to obtain sensitive information via vectors involving the base variable, leading to disclosure of the installation path, a different vulnerability than CVE-2011-2488.
7 CVE-2011-2889 200 +Info 2011-07-27 2011-08-10
5.0
 None Remote Low Not required Partial None None
templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488.
8 CVE-2011-2710 79 XSS 2011-07-27 2011-11-25
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component. NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5.
9 CVE-2011-2509 79 XSS 2011-07-27 2011-07-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, as demonstrated by the filter_order parameter to index.php; (3) the query string to the com_newsfeeds component, as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and, when Internet Explorer or Konqueror is used, (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.
10 CVE-2011-2488 200 +Info 2011-07-27 2011-07-28
5.0
 None Remote Low Not required Partial None None
Joomla! before 1.5.23 does not properly check for errors, which allows remote attackers to obtain sensitive information via unspecified vectors.
11 CVE-2011-0005 79 1 XSS 2011-01-10 2011-01-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the com_search module for Joomla! 1.0.x through 1.0.15 allows remote attackers to inject arbitrary web script or HTML via the ordering parameter to index.php.
12 CVE-2010-4945 89 3 Exec Code Sql 2011-10-09 2012-02-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the CamelcityDB (com_camelcitydb2) component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
13 CVE-2010-4944 89 1 Exec Code Sql 2011-10-09 2012-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Elite Experts (com_elite_experts) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showExpertProfileDetailed action to index.php.
14 CVE-2010-4938 89 Exec Code Sql 2011-10-09 2012-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a categories action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
15 CVE-2010-4696 89 Exec Code Sql 2011-01-18 2011-07-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via the (1) filter_order or (2) filter_order_Dir parameter in a com_contact action to index.php, a different vulnerability than CVE-2010-4166. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
16 CVE-2010-4166 89 Exec Code Sql 2011-01-18 2011-07-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via (1) the filter_order parameter in a com_weblinks category action to index.php, (2) the filter_order_Dir parameter in a com_weblinks category action to index.php, or (3) the filter_order_Dir parameter in a com_messages action to administrator/index.php.
17 CVE-2010-3712 79 XSS 2010-10-27 2011-07-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving "multiple encoded entities," as demonstrated by the query string to index.php in the com_weblinks or com_content component.
18 CVE-2010-2681 94 1 Exec Code File Inclusion 2010-07-12 2010-07-12
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in the SEF404x (com_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig.absolute.path parameter to index.php.
19 CVE-2010-2679 89 1 Exec Code Sql 2010-07-08 2010-07-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
20 CVE-2010-2535 79 XSS 2010-10-05 2010-10-05
3.5
 None Remote Medium Single system None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 allow remote authenticated users to inject arbitrary web script or HTML via administrator screens.
21 CVE-2010-1739 89 2 Exec Code Sql 2010-05-06 2010-05-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the feedid parameter in a categories action to index.php.
22 CVE-2010-1649 79 XSS 2010-06-07 2010-06-25
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in administrator/index.php.
23 CVE-2010-0461 89 2 Exec Code Sql 2010-01-28 2010-01-31
6.5
 User Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the casino (com_casino) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) category or (2) player action to index.php.
24 CVE-2010-0373 89 2 Exec Code Sql 2010-01-21 2010-01-22
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the libros (com_libros) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
25 CVE-2009-4583 89 2 Exec Code Sql 2010-01-06 2010-01-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a grouplist action to index.php.
26 CVE-2009-4579 79 2 XSS 2010-01-06 2010-01-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Artist avenue (com_artistavenue) component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php.
27 CVE-2009-3946 200 +Info 2009-11-16 2009-11-18
5.0
 None Remote Low Not required Partial None None
Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request.
28 CVE-2009-3945 2009-11-16 2009-11-17
5.5
 None Remote Low Single system None Partial Partial
Unspecified vulnerability in the Front-End Editor in the com_content component in Joomla! before 1.5.15 allows remote authenticated users, with Author privileges, to replace the articles of an arbitrary user via unknown vectors.
29 CVE-2009-2239 89 1 Exec Code Sql 2009-06-27 2009-06-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the (1) casinobase (com_casinobase), (2) casino_blackjack (com_casino_blackjack), and (3) casino_videopoker (com_casino_videopoker) components 0.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
30 CVE-2009-2014 89 1 Exec Code Sql 2009-06-09 2009-07-21
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the ComSchool (com_school) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the classid parameter in a showclass action to index.php.
31 CVE-2009-1940 79 XSS 2009-06-05 2009-06-23
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the administrator panel in the com_users core component for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
32 CVE-2009-1939 79 XSS 2009-06-05 2009-06-23
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the JA_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
33 CVE-2009-1938 79 XSS 2009-06-05 2009-06-23
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.
34 CVE-2009-1736 89 1 Exec Code Sql 2009-05-20 2009-05-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php.
35 CVE-2009-1499 89 1 Exec Code Sql 2009-05-01 2009-05-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php. NOTE: SecurityFocus states that this issue has been disputed by the vendor.
36 CVE-2009-1280 352 CSRF 2009-04-09 2009-04-09
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the com_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
37 CVE-2009-1279 79 XSS 2009-04-09 2009-04-09
2.6
 None Remote High Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) com_admin component, (2) com_search component when "Gather Search Statistics" is enabled, and (3) the category view in the com_content component.
38 CVE-2009-0421 89 1 Exec Code Sql 2009-02-04 2009-02-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
39 CVE-2009-0379 89 1 Exec Code Sql 2009-02-02 2009-02-02
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Prince Clan Chess Club (com_pcchess) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the game_id parameter in a showgame action to index.php, a different vector than CVE-2008-0761.
40 CVE-2009-0378 79 1 XSS 2009-02-02 2009-02-02
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action.
41 CVE-2009-0377 89 1 Exec Code Sql 2009-02-02 2009-02-02
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mpid parameter in a sign action to index.php, a different vector than CVE-2008-3132.
42 CVE-2009-0333 89 Exec Code Sql 2009-01-29 2009-01-29
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the WebAmoeba (WA) Ticket System (com_waticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to index.php.
43 CVE-2009-0329 89 1 Exec Code Sql 2009-01-29 2009-01-29
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the PcCookBook (com_pccookbook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the recipe_id parameter in a viewrecipe action to index.php, a different vector than CVE-2008-0844.
44 CVE-2009-0113 22 1 Dir. Trav. 2009-01-09 2009-01-29
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the X_CMS_LIBRARY_PATH HTTP header.
45 CVE-2008-6923 89 1 Exec Code Sql 2009-08-10 2009-08-19
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the content component (com_content) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
46 CVE-2008-6852 89 1 Exec Code Sql 2009-07-07 2009-07-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
47 CVE-2008-6430 89 1 Exec Code Sql 2009-03-06 2009-04-14
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the MyContent (com_mycontent) component 1.1.13 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
48 CVE-2008-6299 79 XSS 2009-02-26 2009-08-13
3.5
 None Remote Medium Single system None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the com_weblinks module and (2) unspecified vectors in the com_content module related to "article submission."
49 CVE-2008-6234 89 1 Exec Code Sql 2009-02-20 2009-02-24
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
50 CVE-2008-6182 89 1 Exec Code Sql 2009-02-19 2011-01-20
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Ignite Gallery (com_ignitegallery) component 0.8.0 through 0.8.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gallery parameter in a view action to index.php.
Total number of vulnerabilities : 262   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.