Mambo-foundation Archives - CVE Vulnerability

CVE-2008-7212

Sun, 26 Feb 2023 09:11:55 +0000

MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message.

The post CVE-2008-7212 appeared first on CVE Vulnerability.

CVE-2008-7213

Sun, 26 Feb 2023 09:11:55 +0000

Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter.

The post CVE-2008-7213 appeared first on CVE Vulnerability.

CVE-2008-7214

Sun, 26 Feb 2023 09:11:55 +0000

Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php.

The post CVE-2008-7214 appeared first on CVE Vulnerability.

CVE-2008-7215

Sun, 26 Feb 2023 09:11:55 +0000

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command, which are used to modify equivalent variables in $_FILES that are accessed when the is_uploaded_file check fails.

The post CVE-2008-7215 appeared first on CVE Vulnerability.

CVE-2008-6814

Sun, 26 Feb 2023 09:11:43 +0000

Unrestricted file upload vulnerability in image_upload.php in the SimpleBoard (com_simpleboard) component 1.0.1 and earlier for Mambo allows remote attackers to execute arbitrary code by uploading a file with an executable extension and an image/jpeg content type, then accessing this file via a direct request to the file in components/com_simpleboard/, a different vulnerability than CVE-2006-3528.

The post CVE-2008-6814 appeared first on CVE Vulnerability.

CVE-2008-6653

Sun, 26 Feb 2023 09:11:38 +0000

SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

The post CVE-2008-6653 appeared first on CVE Vulnerability.

CVE-2008-6481

Sun, 26 Feb 2023 09:11:33 +0000

SQL injection vulnerability in the Versioning component (com_versioning) 1.0.2 in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task to index.php.

The post CVE-2008-6481 appeared first on CVE Vulnerability.

CVE-2008-6234

Sun, 26 Feb 2023 09:11:25 +0000

SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

The post CVE-2008-6234 appeared first on CVE Vulnerability.

CVE-2008-4617

Sun, 26 Feb 2023 09:10:38 +0000

SQL injection vulnerability in the actualite module 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.

The post CVE-2008-4617 appeared first on CVE Vulnerability.

CVE-2008-2497

Sun, 26 Feb 2023 09:09:32 +0000

CRLF injection vulnerability in Mambo before 4.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

The post CVE-2008-2497 appeared first on CVE Vulnerability.