CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

Design/Logic Flaw

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

Joomla! 2.5.x < 2.5.14 / 3.x < 3.1.5 .php. File Upload RCE

According to its self-reported version number, the Joomla! installation running on the remote web server is 2.5.x prior to 2.5.14 or 3.x prior to 3.1.5. It is, therefore, affected by a remote code execution vulnerability due to a failure by the administrator/components/commedia/helpers/media.php...

CVE-2013-2245

rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed...

CVE-2013-2244

CVE-2013-2244 affects Moodle's lib/conditionlib.php, impacting Moodle 2.4.x before 2.4.5 and 2.5.x before 2.5.1. The vulnerability is multiple cross-site scripting (XSS) via the conditional access rule value of a user field, allowing remote attackers to inject arbitrary web script or HTML. Exploi...

Atlassian Crowd XXE Vulnerability (CWD-3366) - Active Check

Atlassian Crowd is prone to an XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Design/Logic Flaw

plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors...

CVE-2013-3059

Cross-site scripting XSS vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-3267

Cross-site scripting XSS vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4532

Cross-site scripting XSS vulnerability in modules/modlanguages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php. NOTE: some of these details are obtained from third party...

Cross site scripting

Cross-site scripting XSS vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4532

CVE-2012-4532 affects Joomla! 2.5.x prior to 2.5.7, where the Language Switcher module (modules/mod_languages/tmpl/default.php) is vulnerable to cross-site scripting via PATH_INFO to index.php. The issue is an XSS in the Language Switcher component, enabling remote injection of script/HTML. The p...

Sql injection

SQL injection vulnerability in Joomla! 1.7.x and 2.5.x before 2.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-1116

CVE-2012-1116 describes an SQL injection vulnerability in Joomla! versions 1.7.x and 2.5.x prior to 2.5.2. Remote attackers can execute arbitrary SQL commands via unspecified vectors. The NVD entry characterizes the impact as partial confidentiality, integrity, and availability loss with network ...

CVE-2012-1611

Joomla! 2.5.x before 2.5.4 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end" information via unknown attack vectors. NOTE: this might be a duplicate of CVE-2012-1599...

Design/Logic Flaw

Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator."...

CVE-2012-3554

SQL injection vulnerability in the RSGallery2 comrsgallery2 component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Joomla! 'index.php'远程特权提升漏洞

Bugtraq ID: 52534 Joomla!是基于php+mysql模式的快速建站系统 Joomla!存在编程错误，允许攻击者利用此漏洞提升特权，执行某些未授权操作 0 Joomla! 2.5.2 Joomla! 2.5.1 Joomla! 2.5 厂商解决方案 Joomla! 2.5.3已经修复此漏洞，建议用户下载使用： http://www.joomla.org/announcements/release-news/5416-joomla-253-released.html...

Information disclosure in FreePBX 2.5.x

Exploit for unknown platform in category web applications ======================================= Information disclosure in FreePBX 2.5.x ======================================= Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class:...