mambo vulnerabilities

Recent CVEs affecting mambo products. 106 tracked.

mambo has 106 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 19. Most recent: 2008-11-25. Highest priority: CVE-2007-1699 (score 64/100).

CVE-2008-5226 HIGH 7.5 DOWNGRADE MITIGATE SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows r
CVE-2008-3712 LOW 2.6 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled
CVE-2008-2990 HIGH 7.5 DOWNGRADE MITIGATE PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) componen
CVE-2008-2905 MEDIUM 6.8 DOWNGRADE PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4
CVE-2008-2500 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in the MOStlyContent Editor (MOStlyCE) component before 3.0 for Mambo
CVE-2008-2095 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the FlippingBook (com_flippingbook) 1.0.4 component for Joomla! al
CVE-2008-2093 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in the Profiler (com_comprofiler) component in Community Builder for Mambo and Joo
CVE-2008-1540 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows r
CVE-2008-1297 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the eWriting (com_ewriting) 1.2.1 module for Mambo and Joomla! all
CVE-2008-1137 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in the Garys Cookbook (com_garyscookbook) 1.1.1 and earlier component for Mambo an
CVE-2008-0855 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in the Facile Forms (com_facileforms) component for Joomla! and Mambo allows remot
CVE-2008-0854 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in the com_salesrep component for Joomla! and Mambo allows remote attackers to exe
CVE-2008-0853 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in the com_detail component for Joomla! and Mambo allows remote attackers to execu
CVE-2008-0849 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allo
CVE-2008-0846 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the com_profile component for Joomla! allows remote attackers to e
CVE-2008-0841 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla!
CVE-2008-0832 HIGH 7.5 UPGRADE UPGRADE SQL injection vulnerability in index.php in the Kemas Antonius com_quran 1.1 and earlier component for Mambo a
CVE-2008-0829 HIGH 7.5 MITIGATE DOWNGRADE SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla!
CVE-2008-0817 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in the com_filebase component for Joomla! and Mambo allows remote attackers to exe
CVE-2008-0810 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in the com_scheduling module for Joomla! and Mambo allows remote attackers to exec
CVE-2008-0799 HIGH 7.5 UPGRADE UPGRADE SQL injection vulnerability in index.php in the Quiz (com_quiz) 0.81 and earlier component for Mambo and Jooml
CVE-2008-0795 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allow
CVE-2008-0773 HIGH 7.5 UPGRADE UPGRADE SQL injection vulnerability in Phil Taylor Comments (com_comments, aka Review Script) 0.5.8.5g and earlier com
CVE-2008-0772 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the com_doc component for Joomla! and Mambo allows remote attacker
CVE-2008-0752 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the Neogallery (com_neogallery) 1.1 component for Joomla! allows r
CVE-2008-0746 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the Gallery (com_gallery) component for Mambo and Joomla! allows r
CVE-2008-0721 HIGH 7.5 DOWNGRADE SQL injection vulnerability in index.php in the Sermon (com_sermon) 0.2 component for Mambo allows remote atta
CVE-2008-0686 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the NeoReferences (com_neoreferences) 1.3.1 and 1.3.3 component fo
CVE-2008-0652 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allo
CVE-2008-0607 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) 2.5.3 compon
CVE-2008-0606 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the Shambo2 (com_shambo2) component for Mambo and Joomla! allows r
CVE-2008-0603 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the amazOOP Awesom! (com_awesom) 0.3.2component for Mambo and Joom
CVE-2008-0561 HIGH 7.5 DOWNGRADE MITIGATE SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component fo
CVE-2008-0519 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the Atapin Jokes (com_jokes) 1.0 component for Mambo and Joomla! a
CVE-2008-0518 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the Recipes (com_recipes) 1.00 component for Mambo and Joomla! all
CVE-2008-0517 HIGH 7.5 DOWNGRADE MITIGATE SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for M
CVE-2008-0515 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the musepoes (com_musepoes) component for Mambo and Joomla! allows
CVE-2008-0514 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in index.php in the Glossary (com_glossary) 2.0 component for Mambo and Joomla! al
CVE-2008-0511 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the MaMML (com_mamml) component for Mambo and Joomla! allows remot
CVE-2008-0510 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla
CVE-2008-0261 MEDIUM 5.0 MITIGATE Unspecified vulnerability in the search component and module in Mambo 4.5.x and 4.6.x allows remote attackers
CVE-2007-6455 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inje
CVE-2007-5362 MEDIUM 6.8 DOWNGRADE MITIGATE Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4
CVE-2007-5177 HIGH 7.5 UPGRADE MITIGATE SQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allo
CVE-2007-4745 MEDIUM 4.3 DOWNGRADE MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in the AkoBook 3.42 and earlier component (com_akobook) fo
CVE-2007-4505 HIGH 7.5 MITIGATE MITIGATE SQL injection vulnerability in index.php in the RemoSitory component (com_remository) for Mambo allows remote
CVE-2007-4456 HIGH 7.5 MITIGATE DOWNGRADE SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remo
CVE-2007-4203 HIGH 9.3 DOWNGRADE Session fixation vulnerability in Mambo 4.6.2 CMS allows remote attackers to hijack web sessions by setting th
CVE-2007-2557 MEDIUM 4.0 DOWNGRADE MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administra
CVE-2007-2196 MEDIUM 6.8 DOWNGRADE DOWNGRADE PHP remote file inclusion vulnerability in jambook.php in the Jambook (com_Jambook) 1.0 beta7 module for Mambo
CVE-2007-2049 MEDIUM 6.8 DOWNGRADE Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow
CVE-2007-2005 MEDIUM 6.8 DOWNGRADE DOWNGRADE Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow
CVE-2007-1702 MEDIUM 6.8 UPGRADE PHP remote file inclusion vulnerability in mod_flatmenu.php in the Flatmenu 1.07 and earlier Mambo module allo
CVE-2007-1699 HIGH 10.0 DOWNGRADE DOWNGRADE Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 compon
CVE-2007-1596 HIGH 9.3 DOWNGRADE DOWNGRADE Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component
CVE-2007-0789 MEDIUM 6.8 UPGRADE SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands vi
CVE-2007-0374 HIGH 7.5 DOWNGRADE DOWNGRADE SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers t
CVE-2006-7202 HIGH 7.8 DOWNGRADE The dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database c
CVE-2006-7150 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands
CVE-2006-7149 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary
CVE-2006-7104 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) a
CVE-2006-6634 HIGH 7.5 UPGRADE Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier compo
CVE-2006-5044 HIGH 7.5 UPGRADE UPGRADE Unspecified vulnerability in Prince Clan (Princeclan) Chess component (com_pcchess) 0.8 and earlier for Mambo
CVE-2006-4556 HIGH 7.5 MITIGATE MITIGATE PHP remote file inclusion vulnerability in index.php in the JIM component for Mambo and Joomla! allows remote
CVE-2006-4553 MEDIUM 6.8 DOWNGRADE DOWNGRADE PHP remote file inclusion vulnerability in plugin.class.php in the com_comprofiler Components 1.0 RC2 for Mamb
CVE-2006-4375 HIGH 7.5 MITIGATE PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD (ContXTD) component for Mambo
CVE-2006-4296 HIGH 7.5 MITIGATE PHP remote file inclusion vulnerability in classes/Tar.php in bigAPE-Backup component (com_babackup) for Mambo
CVE-2006-4288 MEDIUM 6.8 DOWNGRADE PHP remote file inclusion vulnerability in admin.a6mambocredits.php in the a6mambocredits component (com_a6mam
CVE-2006-4286 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_content
CVE-2006-4280 HIGH 7.5 MITIGATE PHP remote file inclusion vulnerability in anjel.index.php in ANJEL (formerly MaMML) Component (com_anjel) for
CVE-2006-4275 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in catalogshop.php in the CatalogShop component for Mambo (com_catalog
CVE-2006-4270 MEDIUM 6.8 UPGRADE PHP remote file inclusion vulnerability in mambelfish.class.php in the mambelfish component (com_mambelfish) 1
CVE-2006-4269 HIGH 7.5 UPGRADE UPGRADE PHP remote file inclusion vulnerability in admin.x-shop.php in the x-shop component (com_x-shop) 1.7 and earli
CVE-2006-4264 CRITICAL 9.8 MITIGATE Multiple PHP remote file inclusion vulnerabilities in the lmtg_myhomepage Component (com_lmtg_myhomepage) for
CVE-2006-3981 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in about.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for
CVE-2006-3980 MEDIUM 6.8 UPGRADE PHP remote file inclusion vulnerability in administrator/components/com_mgm/help.mgm.php in Mambo Gallery Mana
CVE-2006-3962 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the ba
CVE-2006-3949 MEDIUM 6.8 MITIGATE PHP remote file inclusion vulnerability in artlinks.dispnew.php in the Artlinks component (com_artlinks) for M
CVE-2006-3947 MEDIUM 6.8 UPGRADE PHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b
CVE-2006-3846 MEDIUM 6.8 DOWNGRADE PHP remote file inclusion vulnerability in extadminmenus.class.php in the MultiBanners 1.0.1 for Mambo allows
CVE-2006-3843 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in com_calendar.php in Calendar Mambo Module 1.5.7 and earlier allows
CVE-2006-3773 MEDIUM 6.8 DOWNGRADE PHP remote file inclusion vulnerability in smf.php in the SMF-Forum 1.3.1.3 Bridge Component (com_smf) For Joo
CVE-2006-3749 MEDIUM 6.8 DOWNGRADE PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo
CVE-2006-3736 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 a
CVE-2006-3263 HIGH 7.5 UPGRADE SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote at
CVE-2006-3262 HIGH 7.5 UPGRADE SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote at
CVE-2006-1956 MEDIUM 5.0 DOWNGRADE DOWNGRADE The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive informat
CVE-2006-1794 HIGH 7.6 UPGRADE SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to e
CVE-2006-0871 MEDIUM 6.4 DOWNGRADE Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier ve
CVE-2005-4156 HIGH 9.4 DOWNGRADE Unspecified vulnerability in Mambo 4.5 (1.0.0) through 4.5 (1.0.9), with magic_quotes_gpc disabled, allows rem
CVE-2005-3738 LOW 2.6 DOWNGRADE globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attacker
CVE-2005-3586 MEDIUM 5.0 DOWNGRADE content.php in Mambo 4.5.2 through 4.5.2.3 allows remote attackers to obtain the installation path of the appl
CVE-2005-2002 HIGH 7.5 DOWNGRADE SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arb
CVE-2005-0512 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary
CVE-2004-2143 HIGH 7.5 UPGRADE SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier al
CVE-2004-2072 MEDIUM 6.8 DOWNGRADE Cross-site scripting (XSS) vulnerability in index.php for Mambo Open Source 4.6, and possibly earlier versions
CVE-2004-1826 HIGH 7.5 DOWNGRADE SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attac
CVE-2004-1825 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows
CVE-2004-1693 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execut
CVE-2004-1692 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject a
CVE-2003-1203 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in index.php for Mambo Site Server 4.0.10 allows remote attackers to
CVE-2002-2290 HIGH 10.0 DOWNGRADE Mambo Site Server 4.0.11 installs with a default username and password of admin, which allows remote attackers
CVE-2002-2288 MEDIUM 5.0 DOWNGRADE Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request
CVE-2002-2247 MEDIUM 5.0 DOWNGRADE The administrator/phpinfo.php script in Mambo Site Server 4.0.11 allows remote attackers to obtain sensitive i
CVE-2002-1662 MEDIUM 6.8 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11 allow remote attackers to exec
CVE-2001-1011 HIGH 10.0 DOWNGRADE index2.php in Mambo Site Server 3.0.0 through 3.0.5 allows remote attackers to gain Mambo administrator privil

FAQ

How do I fix mambo vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mambo being exploited right now?

None of the tracked mambo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mambo CVE should I patch first?

CVE-2007-1699 currently ranks highest (64/100): Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 compon.

Products

RSS feed for mambo · ← Back to latest CVEs