CVE-2009-4946: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Messaging commessaging component before 1.5.1 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter in a messages action to index.php. NOTE: the provenance of this...

CVE-2009-3334: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component aka JINC or comjinc component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php...