751 matches found
MijoShop, 2.4.x - 2.5.x,
MijoShop, 2.4.x - 2.5.x, SQL Injection Extension Update Details 2.5.2 UpdateNoticeURL http://miwisoft.com/blog/mijoshop-252-security-update-released...
[20131103] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in comcontact...
[20120104] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability...
[20260513] - Core - Privilege escalation through com_users batch task
An improper access check allows privlege escalation through the comusers batch task...
[20260512] - Core - MFA Authentication Bypass
Incorrectly resetted session states to a vector that allows to bypass 2FA checks...
[20260511] - Core - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
[20260507] - Core - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in comtags...
[20250901] - Core - Inadequate content filtering within the checkAttribute filter code
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components...
JoomProject 1.1.3.2 ID
new version number 1.1.3.3 https://www.joomboost.com/blog-updates/joomproject-version-1-1-3-3-security-announcement.html...
Jimtawl 2.2.7 - 'id' SQL Injection
Jimtawl 2.2.7 - 'id' SQL Injection Developer statement update to 2.2.8 http://janguo.de/lang-de/joomla-25-higher/joomla-25-jimtawl-2-1.html...
cms2cms improper file/folder permissions
All these extensions create a folder with permissions 0777, which is not subsequently deleted. CMS2CMS: Automated Blogger to J! Migration CMS2CMS: Automated HTML to J! Migration CMS2CMS: Automated Drupal to J! Migration CMS2CMS: Automated WordPress to J! Migration CMS2CMS Automated WiX to J!...
ZH Yandex Map, 6.1.1.0, SQL Injection
ZH Yandex Map, 6.1.1.0 and previous versions, SQL Injection Resolution: update to 6.2.0.0 Update notice: http://zhuk.cc/2017/10/05/zh-yandexmap-security-update/...
ccNewsletter 2.1.9 and previous, SQL injection
ccNewsletter by Chill Creations, version 2.1.9 and previous, SQL injection resolution: update to 2.2.0 update notice: https://www.chillcreations.com/downloads/ccnewsletter regrettably, the developer seems to have forgotten to notify the VEL...
Appointment, v1.1 ,SQL Injection
Appointment by Harmis Technology joomlaextensions.co.in, v1.1, SQL Injection...
[20161204] - Misc. Security Hardening
Joomla! 3.6.5 includes additional security hardening mechanisms prepared by the JSST, thanks in part to issue reports from Fotis Evangelou and Nicholas Dionysopoulos, which restricts a user's ability to make potentially damaging configuration changes. This includes restricting the ability to set...
SecurityCheck and SecurityCheck Pro Vulnerable Versions: 2.8.9
Stored XSS and SQL Injection in SecurityCheck and SecurityCheck Pro Vulnerable Versions: 2.8.9 possibly below resolution: update to version 2.8.10 update notice: https://securitycheck.protegetuordenador.com/index.php/downloads/securitycheck-j3x...
Payment Form, versions before 4.2
Joomdonation extensions, Information Disclosure Payment Form versions before 4.2 Resolution: update to 4.2 Update notice URL: http://joomdonation.com/forum/payment-form/50514-payment-form-version-4-2-released.html...
Music Collection, 2.4.6 and below, SQL Injection
Music Collection commuscol, 2.4.6 and below, SQL Injection Fixed in 2.4.10 Notice: http://www.joomlathat.com/news/music-collection/music-collection-2-4-9-released-security-release-2...
Responsive Portfolio Wall [mod_repowa], 1.0 and below, XSS (Cross Site Scripting)
Responsive Portfolio Wall modrepowa, 1.0, XSS Cross Site Scripting Extension includes vulnerable version of JS library prettyPhoto Vulnerability fixed in version 1.1 Update notice: http://www.joomlabusiness.net/module/responsive-portfolio-wall...
"EQ Event Calendar" [com_eqfullevent] , 1.0.0 and below
"EQ Event Calendar" by byeqima.com - version: 1.0.0 and lower SQL injection vulnerability...
spider random articles 1.5.0 and previous
spider random articles, all versions prior to 1.5.1 SQL Injection Version 1.5.1 is a "Security Release" and those who use Random Article version under 1.5.1 should upgrade immediately to the latest version!...
eXtplorer 2.1.6 released
http://extplorer.net/news/15 Please update to this new eXtplorer version as it fixes an XSS security issue. Also the UTF-8 fix is recommended for users with non-ASCII filenames...
JEvents pre 3.1.37
Version 3.1.37 eliminates a low risk theoretical XSS exploit and SQL injection exploit. UpdateNoticeURL https://www.jevents.net/jevnews/234-jevents-32 ttweetfsubscribe...
Visforms pre 2.1.2 and pre 3.1.2
Update so that information submitted with Visforms cannot be disclosed unintentionally. http://www.vi-solutions.de/en/announcements/366-security-updates-for-visforms-2-1-2-and-3-1-2-released...
HDFLVPlayer 2.2 + previous
Joomla HDFLVPlayer plugin versions 2.2 and previous SQL Injection Version 2.3 Fixed SQL injection in download.php file.https://www.apptha.com/category/extension/Joomla/HD-FLV-Player Version 2.2 Resolved cross domain issue in download.php & email.php files...
Joomla Mac Gallery 1.5 and below
Joomla Mac Gallery 1.5 and below RFI...
AceSEF , 4.1.2 and below
AceSEF , 4.1.2, SQL Injection...
plg_codehighlight, 1.0.1 , xss
union-d codehighlight, 1.0.1 , XSS Cross Site Scripting...
[20131102] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in comcontact, comweblinks, comnewsfeeds...
Ace SEF4
With the AceSEF 4.0.0, XSS Vulnerability is solved http://www.joomace.net/joomla-extensions/acesef/changelog UpdateNoticeURL http://www.joomace.net/joomla-extensions/acesef-joomla-seo-sef-urls...
sectionex, 2.5.96
sectionex, , SQL Injection Extension Update Details Version 2.5.104 Update Notice URL http://stackideas.com/blog/important-security-release-for-sectionex-2-5...
k2, 2.6.6, Open Folder Permissions
k2, Open folder permissions developer notice http:/getk2.org/blog/1432-k2-v267-released-akismet-integrated-new-acl-option-improved-php-54-support...
Jinc, all versions,
Jinc, all versions, XSS Cross Site Scripting UpdateNotice URL http://lhacky.altervista.org/jextensions/index.php/component/content/article/21-news/jinc/100-security-issue-on-jinc-1-0-1...
flashChart Content Plugin,
flashChart Content Plugin, 1.2.1, XSS Cross Site Scripting Extension Update Details updatet/fixed XSS vulnerability in open-flashchart-swf for external call "get-data" UpdateNoticeURL http://www.jschmidt-systemberatung.de/index.php?lang=en=227...
Phoca Gallery 3x
Phoca Gallery, 3x, SQL Injection...
civic crm 422
upload exploit /RFI 260413 developer http://civicrm.org/category/civicrm-blog-categories/civicrm-v43 release 4.3.1 Authors:...
[20120601] - Core - Privilege Escalation
Inadequate checking leads to possible user privilege escalation...
[20120302] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability...
[20120202] - Core - Information Disclosure
On some servers the error log could be read by unauthorised users...
[20090102] - Core - plg_xstandard Directory Traversal
A crafted request can cause disclosure of the directory structure on the server including any directory that php has access to...
[20260711] - Core - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access comprivacy datasets...
EasyDiscuss by Stackideas,, , SQL Injection
EasyDiscuss by Stackideas,, , SQL Injection...
[20260517] - Core - Incorrect Cache Key Construction for InputFilter objects
The InputFilter::getInstance method omitted a security sensitive parameter from the instance cache key...
JS Jobs extension (v1.4.2)
JS Jobs extension v1.4.2 sqli...
rsfiles!
Extension: RSFiles! Version: Old 1.17.7 / New 1.17.8 Update details: Versions affected 1.16.3 through 1.17.7. Allows unauthenticated remote attackers to deny access to service via search component. Fixed in 1.17.8 Update URL:...
JKassa, 2.0.0, SQL Injection
JKassa, 2.0.0, SQL Injection Update to latest version https://jkassa.com/en/extensions/jkassa.html...
Akeeba LoginGuard,3.1.1 and all lower versions,Information Disclosure
Akeeba LoginGuard,3.1.1 and all lower versions,Information Disclosure Update via developers website...
kunena,5.1.4,Other
kunena,5.1.4,Other statement post: https://www.kunena.org/blog/198-kunena-5-1-5-released...
Community Builder, 2.4.2
Community Builder, 2.4.1 and previous, resolution: update to 2.4.2 update notice: https://www.joomlapolis.com/news/18843-community-builder-2-4-2-security-maintenance-and-features-release...