CVE-2010-0467

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/38378Broken Link, Third Party Advisory
http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.htmlBroken Link, Vendor Advisory
http://www.exploit-db.com/exploits/11277Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/11282Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/37987Broken Link, Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/55953Third Party Advisory, VDB Entry
http://secunia.com/advisories/38378Broken Link, Third Party Advisory
http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.htmlBroken Link, Vendor Advisory
http://www.exploit-db.com/exploits/11277Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/11282Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/37987Broken Link, Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/55953Third Party Advisory, VDB Entry

Timeline

Published: Feb 2, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-04684.3Cross-site scripting (XSS) vulnerability in utilities/longproc.cfm in PaperThin CommonSpot Content Server allows remote attackers to inject CVE-2010-04697.5SQL injection vulnerability in Files2Links F2L 3000 appliance 4.0.0, and possibly other versions and models, allows remote attackers to exec CVE-2010-04704.3Cross-site scripting (XSS) vulnerability in scvrtsrv.cmd in Comtrend CT-507IT ADSL Router allows remote attackers to inject arbitrary web sc CVE-2010-04717.5SQL injection vulnerability in the comment submission interface (includes/comment.php) in Enano CMS before 1.0.6pl1 allows remote attackers CVE-2010-04725.0kuddb2 in Tivoli Monitoring for DB2, as distributed in IBM DB2 9.7 FP1 on Linux, allows remote attackers to cause a denial of service (daemo CVE-2010-04754.3Cross-site scripting (XSS) vulnerability in esp/editUser.esp in the Palo Alto Networks firewall 3.0.x before 3.0.9 and 3.1.x before 3.1.1 al CVE-2010-047610.0The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB server CVE-2010-047710.0The SMB client in Microsoft Windows Server 2008 R2 and Windows 7 does not properly handle (1) SMBv1 and (2) SMBv2 response packets, which al CVE-2010-04789.3Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows CVE-2010-04799.3Buffer overflow in Microsoft Office Publisher 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via CVE-2010-04809.3Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista CVE-2010-04815.5The kernel in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly translate a