Vulnerability List last 3 months from NVD - US Gov.

[jeffchannell]

http://www.exploit-db.com/webapps

Some unlisted ones here...

[mandville]

think i got them all on the vulnerability list http://docs.joomla.org/Vulnerable_Extensions_List unless theres any others you can spot.

there are 2 thats curenty under investigation (Joomla Component mygallery ( farbinform_krell) Remote SQL Injection Vulnerability) and (Google Calendar Component) to find which actual components they are etc

[ot2sen]

Latest LyftenBloggie 1.0.4 Secunia report from yesterday:
http://secunia.com/advisories/37499/

Sent a mail to dev. at their contact form to let them know.

[mandville]

Thanks - added to list and JED reported

[xillibit]

Fireboard has vulnerabilities too, but is not in your list : http://jeffchannell.com/Joomla/kunena-f ... ility.html

UPDATE 3: Kunena is a Joomla 1.5 implementation of Fireboard. As it turns out, Fireboard is also vulnerable to this attack vector.

[mandville]

as we dont have any references to the fireboard vulnerability (that was posted Last Updated on Monday, 06 July 2009 22:15 ), or the time to test out any vulnerability, we have not listed it.
If the developer wishes to contact me via these forums to assure its users, we will be glad to leave it off the list!

[jeffchannell]

*sigh*
http://www.exploit-db.com/exploits/10533

Virtuemart...

[mandville]

*sigh*
http://www.exploit-db.com/exploits/10533

Virtuemart...

yes, i am looking this one atm, and dont you go all "wall of shame" post on me now JeffC

[mandville]

ok its a repeat by a claimer skid.
both exploits i chased refer to version 1.0 VM now at 1.14
compare 10533 and 10407 talk about plagiarism....and its already on the VEL

[jeffchannell]

ok its a repeat by a claimer skid.
both exploits i chased refer to version 1.0 VM now at 1.14
compare 10533 and 10407 talk about plagiarism....and its already on the VEL

Both are from the same person. I'm not sure this still works.

[Shur]

Hi Team,

I'm RAXO All-mode PRO developer (http://extensions.joomla.org/extensions ... news/11399).

I'd like to ask to republish our extension, please.

Vulnerability issue was because of external thumbnail library (TimThumb). Within 12 hours I fixed the problem and released new module version 1.5.0 where this library is updated to the latest secure version.

Security page notice:
http://raxo.org/forum/viewtopic.php?f=2&t=60#p2056

We're sending our clients the updated version since yesterday. But it takes a couple of days to deliver the update to every customer from our list.

Thank you
Alex B.

[mandville]

I'm RAXO All-mode PRO developer (http://extensions.joomla.org/extensions ... news/11399).

I'd like to ask to republish our extension, please.

PLease follow the procedure laid out in
http://docs.joomla.org/Vulnerable_Exten ... om_the_VEL and then visit.
http://[no tiny url]/velunlist
I am locking this topic as it is unrelated and your situation is dealt with by the procedures in the email you recieved.