Joomla JCK Editor 6.4.4 SQL Injection

Title: Joomla Component JCK Editor 6.4.4 - 'parent' SQL Injection Date: 2018-09-14 Exploit Author: Hamza Megahed Vendor Homepage:https://www.joomla.org/ Download: https://arkextensions.com/products/jck-editor Version: 6.4.4 Tested on: Ubuntu, FireFox, CVE: N/A Parameter = parent Payload = " UNION...

Joomla! Component JCK Editor 6.4.4 - 'parent' SQL Injection

Title: Joomla Component JCK Editor 6.4.4 - 'parent' SQL Injection Date: 2018-09-14 Exploit Author: Hamza Megahed Vendor Homepage:https://www.joomla.org/ Download: https://arkextensions.com/products/jck-editor Version: 6.4.4 Tested on: Ubuntu, FireFox, CVE: N/A Parameter = parent Payload = " UNION...

Magiczoomplus for Joomla, 3.3.4, Insecure Folder Permissions

Magiczoomplus for Joomla, versions 3.3.4 and previous, Sensitive information disclosure, Insecure folder permissions, Remote call information disclosure. Resolution: update to 3.3.6 Update notice: https://www.magictoolbox.com/jv-release-update/ Note that the VEL do not agree with the developer's...

Gantry package 5.4.26 ,Other

Gantry package containing "Twig" library creates folders with improper folder permissions. On some servers this may lead to world writeable folders. see https://github.com/gantry/gantry5/issues/2363 https://github.com/twigphp/Twig/issues/2353 developer states not a security issue within their...

Joomla < 3.8.12 Multiple Vulnerabilities

Joomla is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Joomla < 3.8.12 ACL Violation Vulnerability

Joomla is prone to an ACL violation vulnerability in custom fields. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-15882

An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter...

CVE-2018-15881

An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation...

CVE-2018-15880

An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack...

Cross site scripting

An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation...

CVE-2018-15881

An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation...

CVE-2018-15882

An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter...

CVE-2018-15880

An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack...

CVE-2018-15880

An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack...

CVE-2018-15882

An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter...

CVE-2018-15882

CVE-2018-15882 concerns Joomla! before 3.8.12, where inadequate checks in the InputFilter class could allow specifically prepared phar files to bypass the upload filter. The vulnerability enables bypass of upload controls, potentially enabling attackers to introduce malicious content. The issue i...

CVE-2018-15881

CVE-2018-15881 : Joomla! prior to 3.8.12 contains an ACL violation caused by inadequate checks regarding disabled fields in the admin/custom-field flow. This affects the core application’s access-control handling and can allow unauthorized operations that bypass restrictions. The vulnerability is...

CVE-2018-15880

Joomla! before 3.8.12 is vulnerable to a stored XSS on the user profile page due to inadequate output filtering. Affected: Joomla! CMS versions prior to 3.8.12 (noting an additional ACL issue in 3.7.0–3.8.11). Impact, as stated, is stored XSS; no exploitation status is provided. Remediation: upgr...