[20190603] - Core - ACL hardening of com_joomlaupdate

The update server URL of comjoomlaupdate can be manipulated by non Super-Admin users...

Joomla! 1.5.x < 3.9.5 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager component due to improperly sanitizing the folder parameter. An authenticated,...

Joomla! 1.5.0 < 3.9.5 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is 1.5.0 or later but prior to 3.9.5. It is, therefore, affected by multiple vulnerabilities: - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager...

Exploit for CVE-2013-0422

K8tools 20190403 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 博客: https://www.cnblogs.com/k8gege 下载: https://github.com/k8gege/K8tools 密码: k8gege k8team K8team PS: 不定期更新,文件比较大，可按需下载。 提权工具均可在远控cmd或WebShell下运行，大部份经过修改重新编译兼容性稳定性比网上要好 综合工具 + 综合工具 K8飞刀Final.rar + K8data.mdb K8飞刀漏洞数据库20190402 + K8expList.txt K8飞刀漏洞利用列表...

Joomla ChronoConnectivity2 Component SQL Injection Vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla ChronoConnectivity2 component. Due to failure to adequately come over user-supplied data before using it in a SQL query. Allows an attacker to compromise the application, access or modify...

Joomla Sobi2 SobiPro Component SQL Injection Vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla Sobi2 SobiPro component. An attacker can exploit the vulnerability to obtain sensitive database information...

Harmis JE Messenger Improper Access Control Vulnerability (CNVD-2019-14099)

Joomla! is an open source, cross-platform content management system CMS developed by the Open Source Matters team in the United States using PHP and MySQL. Harmis JE Messenger component is used in one of the personal messaging components, which supports incoming and outgoing e-mail and online...

Harmis JE Messenger Cross-Site Scripting Vulnerability

Joomla! is an open source, cross-platform content management system CMS developed by the Open Source Matters team in the United States using PHP and MySQL. Harmis JE Messenger component is used in one of the personal messaging components, which supports incoming and outgoing e-mail and online...

SQL injection vulnerability in Joomla! component zma***

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system , the system provides RSS feeds , site search and other functions . A SQL injection vulnerability exists in the Joomla! component zma, which originates when the program does not properly handle...

Harmis JE Messenger Component Access Control Error Vulnerability in Joomla!

Joomla! is an open source, cross-platform content management system CMS developed by the Open Source Matters team in the United States using PHP and MySQL. Harmis JE Messenger component is used in one of the personal messaging components, which supports incoming and outgoing e-mail and online...

SQL Injection Vulnerability in Joomla! component KSA*** parameters

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other functions.KSAdvertiser is Joomla advertising components. There is a SQL injection vulnerability in the KSA parameter of the Joomla!...

SQL Injection Vulnerability in Joomla! component KSA*** parameters

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other functions . A SQL injection vulnerability exists in the KSA parameter of the Joomla! component. The vulnerability stems from th...

Harmis JE Messenger Component SQL Injection Vulnerability in Joomla!

Joomla! is an open source, cross-platform content management system CMS developed by the Open Source Matters team in the United States using PHP and MySQL. Harmis JE Messenger component is used in one of the personal messaging components, which supports incoming and outgoing e-mail and online...

Harmis JE Messenger component path traversal vulnerability in Joomla!

Joomla! is an open source, cross-platform content management system CMS developed by the Open Source Matters team in the United States using PHP and MySQL. Harmis JE Messenger component is used in one of the personal messaging components, which supports incoming and outgoing e-mail and online...

Hackers using hacked WordPress & Joomla sites to drop malware

By Waqas Apparently, the malware attack is carried out by Russian speaking hackers. The IT security researchers at Zscaler have discovered a sophisticated malware campaign targeting websites based on WordPress and Joomla content management system CMS. The campaign works in such a way that hackers...

Information disclosure

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to read information that should only be accessible by a different user...

CVE-2019-9921

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to read information that should only be accessible by a different user...

Design/Logic Flaw

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to perform an action within the context of the account of another user...

CVE-2019-9918

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and queries are not written in a way to prevent SQL injection. Therefore arbitrary SQL-Statements can be executed in the database...

CVE-2019-9918

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and queries are not written in a way to prevent SQL injection. Therefore arbitrary SQL-Statements can be executed in the database...