49 matches found
[20190501] - Core - XSS in com_users ACL debug views
The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...
Design/Logic Flaw
An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of comusers lacks access checks, allowing calls from unauthenticated users...
CVE-2019-10946
Joomla! before 3.9.5 is affected by CVE-2019-10946 due to missing access checks on the refresh list of helpsites endpoint in com_users, allowing unauthenticated calls. Affected versions include 3.9.4 and earlier; remediation is to upgrade to Joomla! 3.9.5 (or later) where this is fixed.
Joomla! 1.5.x < 3.9.5 Multiple Vulnerabilities
According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager component due to improperly sanitizing the folder parameter. An authenticated,...
Joomla! 1.5.0 < 3.9.5 Multiple Vulnerabilities
According to its self-reported version number, the Joomla! installation running on the remote web server is 1.5.0 or later but prior to 3.9.5. It is, therefore, affected by multiple vulnerabilities: - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager...
[20190402] - Core - Helpsites refresh endpoint callable for unauthenticated users
The "refresh list of helpsites" endpoint of comusers lacks access checks, allowing calls from unauthenticated users...
JoostinaCMS component (com_users) Blind SQL Injection Vulnerability
Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...
joomla -- multiple vulnerabilities
Secunia reports: Some vulnerabilities have been reported in Joomla!, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks. Certain unspecified input is not properly sanitised before being used. This can be...