CVE-2010-1949
published 2010-05-19CVE-2010-1949: SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL…
PriorityP346high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
1.83%
76.2th percentile
SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php. NOTE: some of these details are obtained from third party information.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| emultisoft | com_jnewspaper | — | — |
| plone | plone | >= 3.3.2 < 3.3.6 | 3.3.6 |
| plone | plone | >= 4.0a0 < 4.0.6 | 4.0.6 |
| plone | plone | >= 4.1a0 < 4.1.1 | 4.1.1 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa4.3MEDIUM
vendor_redhat4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6mjg-7996-86jv: SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1
ghsa_unreviewed·2022-05-17
CVE-2010-1949 [HIGH] CWE-89 GHSA-6mjg-7996-86jv: SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1
SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php. NOTE: some of these details are obtained from third party information.
GHSA
Plone Cross-site Scripting vulnerability
ghsa·2018-07-23·CVSS 4.3
CVE-2011-1949 [MEDIUM] CWE-79 Plone Cross-site Scripting vulnerability
Plone Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.
Red Hat
plone: A persistent cross site scripting vulnerability
vendor_redhat·2011-05-31·CVSS 4.3
CVE-2011-1949 [MEDIUM] CWE-79 plone: A persistent cross site scripting vulnerability
plone: A persistent cross site scripting vulnerability
Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.
Statement: This issue did not affect the versions of conga package as shipped with Red Hat Enterprise Linux 5 and with Red Hat Cluster Suite for Red Hat Enterprise Linux 4, as they did not include support for creation of new Plone content.
Package: conga (Red Hat Enterprise Linux 5) - Not affected
No detection rules found.
2010-05-19
Published