CVE-2020-35611

CVE-2020-35611 affects Joomla! 2.5.0 through 3.9.22. The global configuration page outputs secrets in the HTML, disclosing current values due to a misconfiguration. Impact is information disclosure of sensitive configuration data. Remediation: update to a version that removes secrets from the HTM...

CVE-2020-35612

The CVE-2020-35612 issue affects Joomla! 2.5.0 through 3.9.22. The vulnerability arises in the mod_random_image folder parameter, where input validation is missing, enabling path traversal. Impact is described as a path traversal vulnerability, with no details on exploit vectors in the provided s...

CVE-2020-35610

CVE-2020-35610 affects Joomla! 2.5.0 through 3.9.22 where the autosuggestion feature of the component com_finder ignores the access level of terms, potentially exposing restricted information. The issue is described across multiple sources, noting the same root cause and affected range. The CVSS ...

CVE-2020-35616

Joomla! versions 1.7.0 through 3.9.22 are affected by an ACL write-violation vulnerability due to insufficient input validation when processing ACL rulesets. The issue can lead to write ACL violations in multiple core views, with the security entries indicating a high integrity impact (CVE-2020-3...

CVE-2020-35613

CVE-2020-35613 affects Joomla! 3.0.0 through 3.9.22. The issue is a SQL injection in the backend user list caused by an improperly configured filter blacklist. Multiple sources in the connected data corroborate this vulnerability in the core; the root cause is the flawed filter blacklist allowing...

CVE-2020-35615

Summary: CVE-2020-35615 affects Joomla! core components. Affected versions: Joomla! 2.5.0 through 3.9.22. Issue: a missing token check in the emailexport feature of the Privacy (com_privacy) component allows CSRF. Impact (as stated): CSRF vulnerability with low to moderate potential impact on int...

CVE-2020-35614

Joomla! is affected from 3.9.0 through 3.9.22 by a backend login user enumeration vulnerability caused by improper handling of the username. The issue enables an attacker to infer valid usernames via the backend login page. Remediation per linked sources is to update Joomla! to a version that fix...

CVE-2020-35615 [20201106] - Core - CSRF in com_privacy emailexport feature

An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of comprivacy causes a CSRF vulnerability...

CVE-2020-35616 [20201107] - Core - Write ACL violation in multiple core views

An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations...

CVE-2020-35611 [20201102] - Core - Disclosure of secrets in Global Configuration page

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values...

CVE-2020-35613 [20201104] - Core - SQL injection in com_users list view

An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list...

Exploit for SQL Injection in Joomla Joomla\!

CyberspaceSecurityLearning 在学习CTF、网络安全路上整合博客和一些资料，持续更新 置顶tips：如果你也有自己学习路上收集的一些好资料，或者愿意展示自己的优质博客给大家欢迎fork pull request给我（联系邮箱[email protected]） 最新更新时间：2018/3/13 更新内容： 任意用户密码重置（五）：重置凭证可暴破 一些有趣的代码审计“小”题目为CTF-Web-dog提供一些套路 了解SSRF,这一篇就足够了 知识技能表 知道创宇技能表 CTF练习 Writeup 这是我自己从最早入门开始练习的一些题目往下排列的，可能很多当时写的writ...

Joomla! 跨站请求伪造漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in Joomla! 2.5.0 - 3.9.22. The...

PT-2020-17367 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.22 Description: A missing token check in the emailexport feature of com privacy causes a CSRF issue. Recommendations: For Joomla! versions 2.5.0 through 3.9.22, update to a version that includes the fix for...

Joomla! 输入验证错误漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. An ACL write conflict vulnerability exists in Joomla! 1.7.0-3.9.22. The...

Joomla! 信息泄露漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. An information disclosure vulnerability exists in Joomla! 2.5.0-3.9.22. The...

Joomla SQL注入漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A SQL injection vulnerability exists in the back-end user list of Joomla! 3.0.0 -...

PT-2020-17366 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.9.0 through 3.9.22 Description: An issue was discovered that leads to a user enumeration attack vector in the backend login page due to improper handling of the username. Recommendations: For Joomla! versions 3.9.0 through...

Joomla! 路径遍历漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A path traversal vulnerability exists in Joomla! 2.5.0 - 3.9.22. The vulnerabilit...

PT-2020-17362 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.22 Description: An issue was discovered where the autosuggestion feature of com finder did not respect the access level of the corresponding terms. Recommendations: For Joomla! versions 2.5.0 through 3.9.22,...