19307 matches found
Joomla 2.5.x < 3.10.7 / 4.0.x < 4.1.1 Multiple Vulnerabilities (5857-joomla-4-1-1-and-3-10-7-release)
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.10.7 or 4.0.x prior to 4.1.1. It is, therefore, affected by multiple vulnerabilities. - An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an...
PT-2022-16265 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.10.6 Joomla! versions 4.0.0 through 4.1.0 Description: An issue was discovered where extracting a specifically crafted tar package could write files outside of the intended path. Recommendations: For Joomla!...
PT-2022-16267 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.10.6 Joomla! versions 4.0.0 through 4.1.0 Description: An issue was discovered where a user row was not bound to a specific authentication mechanism, which could under very special circumstances allow an accou...
Joomla! 3.0.0 - 3.10.6, 4.0.0 - 4.1.0 Multiple Vulnerabilities
Joomla! is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla"; ifdescription...
PT-2022-16273 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 4.0.0 through 4.1.0 Description: An issue was discovered in Joomla, allowing a possible XSS attack vector through SVG embedding in com media. Recommendations: For Joomla! versions 4.0.0 through 4.1.0, consider disabling the S...
PT-2022-16266 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.10.6 Joomla! versions 4.0.0 through 4.1.0 Description: An issue was discovered where uploading a file with an excessively long name causes an error. This error results in the display of the web application's...
PT-2022-16268 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.7.0 through 3.10.6 Description: The issue is related to a lack of input validation, which could allow an XSS attack using com fields. Recommendations: For Joomla! versions 3.7.0 through 3.10.6, update to a version that...
PT-2022-16272 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 4.0.0 through 4.1.0 Description: An issue was discovered in Joomla! due to inadequate content filtering, leading to XSS vulnerabilities in various components. Recommendations: For Joomla! versions 4.0.0 through 4.1.0, update ...
Joomla! 4.1.0 Zip Slip File Overwrite / Path Traversal
------------------------------------------------- Joomla! getTarInfo$this-data; 114. 115. for $i = 0, $n = \count$this-metadata; $i metadata$i'type'; 118. 119. if $type == 'file' || $type == 'unix file' 120. 121. $buffer = $this-metadata$i'data'; 122. $path = Path::clean$destination . '/'...
PT-2022-16269 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.10.6 Joomla! versions 4.0.0 through 4.1.0 Description: An issue was discovered in Joomla! where inadequate filtering on the selected Ids in a request could result in a possible SQL injection. Recommendations:...
Joomla! 4.1.0 Zip Slip File Overwrite / Path Traversal Vulnerabilities
Joomla! versions 4.1.0 and below suffer from path traversal and file overwrite vulnerabilities due to misplaced trust in the handling of compressed archives. ------------------------------------------------- Joomla! getTarInfo$this-data; 114. 115. for $i = 0, $n = \count$this-metadata; $i...
CVE-2022-23795
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover...
CVE-2022-23798
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...
CVE-2022-23797
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection...
CVE-2022-23801
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...
CVE-2022-23799
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $REQUEST data...
XSS within joomla/filter class
More info at https://developer.joomla.org/security-centre/877-20220308-core-inadequate-content-filtering-within-the-filter-code.html...
Path Disclosure within joomla/filesystem class
More info at https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html...
CVE-2022-23793
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path...