Directory traversal vulnerability in the JA News (comjanews) component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.
Directory traversal vulnerability in the JE Form Creator (comjeformcr) component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE: the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected.
Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (JwallVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
SQL injection vulnerability in the casino (comcasino) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) category or (2) player action to index.php.
Directory traversal vulnerability in the JoomlaPraise Projectfork (comprojectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
Cross-site scripting (XSS) vulnerability in the JAPurity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.
Cross-site scripting (XSS) vulnerability in the administrator panel in the comusers core component for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (comtreeg) component 1.0 for Joomla!, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfiglivesite parameter.
Multiple SQL injection vulnerabilities in the GigCalendar (comgigcal) component 1.0 for Mambo and Joomla!, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal venuesid parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcalbandsid parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.
Directory traversal vulnerability in the Pro Desk Support Center (comprodesk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the includefile parameter to index.php.
Directory traversal vulnerability in captcha/captchaimage.php in the RWCards (comrwcards) 3.0.11 component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.
Directory traversal vulnerability in download.php in the ionFiles (comionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (combeamospetition) 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action.
Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the XCMSLIBRARYPATH HTTP header.
Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (comclickheat) component 1.0.1 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[mosConfigabsolutepath] parameter to (a) install.clickheat.php, (b) Cache.php and (c) ClickheatHeatmap.php in Recly/Clickheat/, and (d) Recly/common/GlobalVariables.php; and the (2) mosConfigabsolutepath parameter to (e) main.php and (f) main.php in includes/heatmap, and (g) includes/overview/main.php.
Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model.
Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors.
Cross-site scripting (XSS) vulnerability in the compoll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (comjfu or comjoomlaflashuploader) 2.5.1 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to (1) install.joomlaflashuploader.php and (2) uninstall.joomlaflashuploader.php.
PHP remote file inclusion vulnerability in admin.color.php in the comcolorlab (aka comcolor) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter.
Cross-site scripting (XSS) vulnerability in the comsearch component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter. NOTE: this might be related to CVE-2007-4189.1.
PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (comwmtrssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter.
DISPUTED PHP remote file inclusion vulnerability in preview.php in the swMenuFree (comswmenufree) 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. NOTE: a reliable third party disputes this issue because preview.php tests a certain constant to prevent direct requests.
Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite (commosmedia) 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to (1) credits.html.php, (2) info.html.php, (3) media.divs.php, (4) media.divs.js.php, (5) purchase.html.php, or (6) support.html.php in includes/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: vector 3 may be the same as CVE-2007-2043.2.
PHP remote file inclusion vulnerability in admin.panoramic.php in the Panoramic Picture Viewer (companoramic) mambot (plugin) 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (comwmtportfolio) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter.
PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (comwmtgallery) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter.
administrator/index.php in the installer component (cominstaller) in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to tmp/ via the "Upload Package File" functionality, which is accessible when cominstaller is the value of the option parameter.
Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to obtain sensitive information (the full path) via unspecified vectors, probably involving direct requests to certain PHP scripts in tmpl/ directories.