Cross site scripting

In Joomla! before 3.9.19, incorrect input validation of the module tag option in commodules allows XSS...

Design/Logic Flaw

In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users...

Cross site scripting

In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS...

Cross site request forgery (csrf)

In Joomla! before 3.9.19, missing token checks in compostinstall lead to CSRF...

CVE-2020-13760

CVE-2020-13760 affects Joomla! versions prior to 3.9.19 due to missing token checks in com_postinstall, enabling CSRF. Multiple connected sources (Red Hat, OSV, OpenVAS/Nessus entries) corroborate the description. CVSS‑3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8 (H...

CVE-2020-13760

In Joomla! before 3.9.19, missing token checks in compostinstall lead to CSRF...

CVE-2020-13761

CVE-2020-13761 affects Joomla! prior to 3.9.19. The issue is a lack of input validation in the heading tag option of the Articles - Newsflash and Articles - Categories modules, enabling Cross-Site Scripting (XSS). Exploitation would occur via crafted input in those modules, leading to script exec...

CVE-2020-13761

In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS...

CVE-2020-13762

CVE-2020-13762 affects Joomla! versions before 3.9.19, where incorrect input validation of the module tag option in com_modules enables cross-site scripting (XSS). The issue is confirmed in multiple later datasets referencing Joomla! 3.9.19 as the fixed version. Affected component: com_modules mo...

CVE-2020-13762

In Joomla! before 3.9.19, incorrect input validation of the module tag option in commodules allows XSS...

CVE-2020-13763

CVE-2020-13763 affects Joomla!

CVE-2020-13763

In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users...

PT-2020-13664 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.19 Description: The default settings of the global textfilter configuration in Joomla! do not block HTML inputs for Guest users. This issue may allow unauthorized users to inject malicious HTML code...

PT-2020-13663 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.19 Description: The issue arises from incorrect input validation of the module tag option in com modules, allowing for cross-site scripting XSS. Recommendations: For versions prior to 3.9.19, update to version...

PT-2020-13662 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.19 Description: The issue is related to a lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules, which allows for cross-site scripting XSS...

PT-2020-13661 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.19 Description: The issue is related to missing token checks in the com postinstall component, which leads to Cross-Site Request Forgery CSRF. CSRF is an attack where an attacker tricks a user into performing...

Joomla suffers security breach exposing user records

By Deeba Ahmed It total, 2,700 Joomla user records were exposed, Hackread.com has learned. This is a post from HackRead.com Read the original post: Joomla suffers security breach exposing user records...

Joomla Resources Directory (JRD) Portal Suffers Data Breach

Joomla, one of the most popular Open-source content management systems CMS, last week announced a new data breach impacting 2,700 users who have an account with its resources directory JRD website, i.e., resources.joomla.org. The breach exposed affected users' personal information, such as full...

Joomla Resources Directory (JRD) Portal Suffers Data Breach

Joomla, one of the most popular Open-source content management systems CMS, last week announced a new data breach impacting 2,700 users who have an account with its resources directory JRD website, i.e., resources.joomla.org. The breach exposed affected users' personal information, such as full...

Joomla SimpleCalendar Component SQL Injection (CVE-2018-5974)

A vulnerability exists in Albonico Simplecalendar. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...