mambo vulnerabilities and fixes

Recent CVEs affecting mambo, with upgrade or downgrade steps. 37 tracked.

mambo has 37 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 13. Most recent: 2011-12-08. Highest priority: CVE-2006-1794 (score 55/100).

• CVE-2011-3754 MEDIUM 5.0 DOWNGRADE Mambo 4.6.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which
• CVE-2011-2917 HIGH 7.5 UPGRADE SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers
• CVE-2008-7215 MEDIUM 5.8 UPGRADE UPGRADE The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to renam
• CVE-2008-7214 MEDIUM 6.8 UPGRADE UPGRADE Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in
• CVE-2008-7213 MEDIUM 4.3 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/
• CVE-2008-7212 MEDIUM 5.0 UPGRADE UPGRADE MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive informati
• CVE-2008-5226 HIGH 7.5 DOWNGRADE MITIGATE SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows r
• CVE-2008-3712 LOW 2.6 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled
• CVE-2008-2905 MEDIUM 6.8 DOWNGRADE PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4
• CVE-2008-2498 HIGH 7.5 UPGRADE Multiple SQL injection vulnerabilities in index.php in Mambo before 4.6.4, when magic_quotes_gpc is disabled,
• CVE-2008-2497 MEDIUM 5.0 UPGRADE CRLF injection vulnerability in Mambo before 4.6.4 allows remote attackers to inject arbitrary HTTP headers an
• CVE-2008-0829 HIGH 7.5 MITIGATE DOWNGRADE SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla!
• CVE-2008-0795 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allow
• CVE-2008-0562 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the Restaurant (com_restaurant) 1.0 component for Mambo and Joomla
• CVE-2008-0561 HIGH 7.5 DOWNGRADE MITIGATE SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component fo
• CVE-2008-0517 HIGH 7.5 DOWNGRADE MITIGATE SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for M
• CVE-2008-0510 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla
• CVE-2007-6455 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inje
• CVE-2007-5362 MEDIUM 6.8 DOWNGRADE MITIGATE Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4
• CVE-2007-5177 HIGH 7.5 UPGRADE MITIGATE SQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allo
• CVE-2007-4505 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the RemoSitory component (com_remository) for Mambo allows remote
• CVE-2007-4456 HIGH 7.5 MITIGATE DOWNGRADE SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remo
• CVE-2007-2557 MEDIUM 4.0 DOWNGRADE MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administra
• CVE-2007-0789 MEDIUM 6.8 UPGRADE SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands vi
• CVE-2007-0374 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers t
• CVE-2006-7149 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary
• CVE-2006-4286 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_content
• CVE-2006-3263 HIGH 7.5 UPGRADE SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote at
• CVE-2006-3262 HIGH 7.5 UPGRADE SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote at
• CVE-2006-1957 MEDIUM 5.0 MITIGATE MITIGATE The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service
• CVE-2006-1956 MEDIUM 5.0 DOWNGRADE DOWNGRADE The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive informat
• CVE-2006-1794 HIGH 7.6 UPGRADE SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to e
• CVE-2006-0871 MEDIUM 6.4 DOWNGRADE Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier ve
• CVE-2005-3586 MEDIUM 5.0 DOWNGRADE content.php in Mambo 4.5.2 through 4.5.2.3 allows remote attackers to obtain the installation path of the appl
• CVE-2005-2002 HIGH 7.5 DOWNGRADE SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arb
• CVE-2005-0512 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary
• CVE-2004-1693 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execut

FAQ

How do I fix mambo vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mambo being exploited right now?

None of the tracked mambo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mambo CVE should I patch first?

CVE-2006-1794 currently ranks highest (55/100): SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to e.

RSS feed for mambo · ← Back to latest CVEs