Joomla! < 3.8.13 Multiple Vulnerabilities

Joomla! is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla"; ifdescription...

Joomla! < 3.8.13 RCE Vulnerability

comjoomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access comjoomlaupdate and trigger code execution. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

Joomla! JCK Editor component SQL injection vulnerability

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other features . JCK Editor is one of the editor component . A SQL injection vulnerability exists in the Joomla! A remote attacker can exploit...

Joomla! < 3.8.13 Access Level Violation Vulnerability

Inadequate checks on the tags search fields can lead to an access level violation. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-17859

An issue was discovered in Joomla! before 3.8.13. Inadequate checks in comcontact could allow mail submission in disabled forms...

CVE-2018-17859

An issue was discovered in Joomla! before 3.8.13. Inadequate checks in comcontact could allow mail submission in disabled forms...

CVE-2018-17857

An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation...

CVE-2018-17855

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself...

CVE-2018-17857

An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation...

CVE-2018-17858

An issue was discovered in Joomla! before 3.8.13. cominstaller actions do not have sufficient CSRF hardening in the backend...

Code injection

An issue was discovered in Joomla! before 3.8.13. comjoomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access comjoomlaupdate and trigger code execution...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation...

Cross site request forgery (csrf)

An issue was discovered in Joomla! before 3.8.13. cominstaller actions do not have sufficient CSRF hardening in the backend...

CVE-2018-17856

An issue was discovered in Joomla! before 3.8.13. comjoomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access comjoomlaupdate and trigger code execution...

CVE-2018-17856

An issue was discovered in Joomla! before 3.8.13. comjoomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access comjoomlaupdate and trigger code execution...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.8.13. Inadequate checks in comcontact could allow mail submission in disabled forms...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself...

CVE-2018-17855

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself...

CVE-2018-17858

An issue was discovered in Joomla! before 3.8.13. cominstaller actions do not have sufficient CSRF hardening in the backend...

CVE-2018-17856

Summary: CVE-2018-17856 affects Joomla! before 3.8.13. The com_joomlaupdate component permits arbitrary code execution due to a default ACL configuration that allows Administrator-level users to access com_joomlaupdate. This leads to remote code execution with high impact; CVSSv3 base score 7.2 (...