[20151206] - Core - Session Hardening

The Joomla Security Strike team has been following up on the critical security vulnerability patched last week. Since the recent update it has become clear that the root cause is a bug in PHP itself. This was fixed by PHP in September of 2015 with the releases of PHP 5.4.45, 5.5.29, 5.6.13 Note...

[20201103] - Core - Path traversal in mod_random_image

The folder parameter of modrandomimage lacked input validation, leading to a path traversal vulnerability...

[20210102] - Core - XSS in mod_breadcrumbs aria-label attribute

Lack of escaping in modbreadcrumbs aria-label attribute allows XSS attacks...

[20170902] - Core - LDAP Information Disclosure

Inadequate escaping in the LDAP authentication plugin can result into a disclosure of username and password...

[20161202] - Core - Shell Upload

Inadequate filesystem checks allowed files with alternative PHP file extensions to be uploaded...

BK MultiThumb [multithumb], 3.7.1 and below, XSS (Cross Site Scripting)

BK-MultiThumb, 3.7.1 and below, XSS Cross Site Scripting Extension contains known vulnerable version of JS library prettyPhoto. The vulnerability in JS file was patched by extension author on basis of 3.1.5 file. Update notice: http://joomla.rjews.net/bk-multithumb...

[20240205] - Core - Inadequate content filtering within the filter code

Inadequate content filtering leads to XSS vulnerabilities in various components...

[20201101] - Core - com_finder ignores access levels on autosuggest

The autosuggestion feature of comfinder did not respect the access level of the corresponding terms...

[20200303] - Core - Incorrect Access Control in com_templates

Various actions in comtemplates lack the required ACL checks, leading to various potential attack vectors...

J-Business Directory by CMS Junkie, 4.6.8, SQL Injection

J-Business Directory by CMS Junkie, 4.6.8, SQL Injection Resolution: update to 4.7.3 Update Notice URL: http://www.cmsjunkie.com/blog/cat/news-joomla-business-directory/post/joomlabusinessdirectory4-7-3release...

[20090722] - Core - Missing JEXEC Check

Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host...

[20210103] - Core - XSS in com_tags image parameters

Lack of escaping of image-related parameters in multiple comtags views cause lead to XSS attack vectors...

[20200304] - Core - Identifier collisions in com_users

Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses...

[20230102] - Core - Missing ACL checks for com_actionlogs

A missing ACL check allows non super-admin users to access comactionlogs...

[20220305] - Core - Inadequate filtering on the selected Ids

Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection...

[20200802] - Core - Open redirect in com_content vote feature

Lack of input validation in comcontent leads to an open redirect...

[20190102] - Core - Stored XSS in com_contact

Inadequate escaping in comcontact leads to a stored XSS vulnerability...

JSP Tickets, 1.1, SQL Injection

JSP Tickets from Joomla Service Provider, versions 1.1 and previous, SQL Injection Resolution: update to version 1.2.0 Update notice: http://www.joomlaserviceprovider.com/jspblog/jsp-tickets-1-2-security-release.html...

[20220301] - Core - Zip Slip within the Tar extractor

Extracting an specifilcy crafted tar package could write files outside of the intended path...

[20180506] - Core - Filter field in com_fields allows remote code execution

Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option...

[20120307] - Core - Information Disclosure

Inadequate permission checking allows unauthorised viewing of some administrative back end information...

[20191201] - Core - Path Disclosure in framework files

Missing access check in framework files could lead to a path disclosure...

Big File Uploader by Prismanet,1.0.2, Insecure File Upload

Big File Uploader by Prismanet, 1.0.2, Insecure File Upload...

[20240204] - Core - XSS in mail address outputs

Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components...

[20201105] - Core - User Enumeration in backend login

Improper handling of the username leads to a user enumeration attack vector in the backend login page...

[20200603] - Core - XSS in com_modules tag options

Incorrect input validation of the module tag option in commodules allow XSS attacks...

[20180601] - Core - Local File Inclusion with PHP 5.3

Our autoload code checks classnames to be valid, using the "classexists" function in PHP. In PHP 5.3 this function validates invalid names as valid, which can result in a Local File Inclusion...

[20180509] - Core - XSS vulnerability in the media manager

Inadequate filtering of file and folder names lead to various XSS attack vectors in the media manager...

[20230101] - Core - CSRF within post-installation messages

A missing token check causes a CSRF vulnerability in the handling of post-installation messages...

[20220306] - Core - Inadequate validation of internal URLs

Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...

[20200704] - Core - Variable tampering via user table class

Internal read-only fields in the User table class could be modified by users...

[20210304] - Core - XSS within the feed parser library

Missing filtering of feed fields could lead to xss issues...

RSForm! Pro,2.2.0 (March 2019),Other

RSForm! Pro,2.2.0 March 2019,Other new version number 2.2.1 UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...

[20190301] - Core - XSS in com_config JSON handler

The JSON handler in comconfig lacks input validation, leading to XSS vulnerability...

[20130404] - Core - XSS Vulnerability

Use of old version of Flash-based file uploader leads to XSS vulnerability...

[20081102] - Core - com_weblinks XSS vulnerability

comweblinks allows raw HTML into the title and description tags for weblink submissions from both the administrator and site submission forms...

[20230502] - Core - Bruteforce prevention within the mfa screen

The lack of rate limiting allows brute force attacks against MFA methods...

[20220308] - Core - Inadequate content filtering within the filter code

Inadequate content filtering leads to XSS vulnerabilities in various components...

[20181002] - Core - Inadequate default access level for com_joomlaupdate

Joomla’s comjoomlaupdate allows the execution of arbitrary code. The default ACL config enabled access of Administrator-level users to access comjoomlaupdate and trigger a code execution...

Timetable Responsive Schedule, 1.6, SQL injection

Timetable Responsive Schedule For Joomla by QuanticaLabs, versions 1.6. and previous, SQL injection Resolution: update to 1.7 update notice: https://codecanyon.net/item/timetable-responsive-schedule-for-joomla/9749539item-descriptionupdates...

[20171102] - Core - 2-factor-authentication bypass

A bug allowed third parties to bypass a user's 2-factor-authentication method...

Street Guesser,1.1.7,SQL Injection

Street Guesser by Nordmograph,1.1.7,SQL Injection resolution: update to 1.1.8 update notice: https://www.nordmograph.com/extensions/index.php?option=comvirtuemart=productdetailsproductid=160categoryid=1=58...

[20090723] - Core - com_mailto Timeout Issue

In commailto, it was possible to bypass timeout protection against sending automated emails...

RealPin by Frumania, SQL, 1.5.04

Name: Realpin Old 1.5.04 / New 1.6.0 Update details: Fixed risk of SQL Injection Update URL: https://realpin.frumania.com/...

[20210101] - Core - com_modules exposes module names

Lack of ACL checks in the orderPosition endpoint of commodules leak names of unpublished and/or inaccessible modules...

[20190701] - Core - Filter attribute in subform fields allows remote code execution

Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option...

[20190206] - Core - Implement the TYPO3 PHAR stream wrapper

The phar:// stream wrapper can be used for objection injection attacks. We now disallow usage of the phar:// handler for non .phar-files within the CMS globally by implementing the TYPO3 PHAR stream wrapper...

[20190103] - Core - Stored XSS issue in the Global Configuration textfilter settings

Inadequate checks at the Global Configuration Text Filter settings allowed a stored XSS...

[20180502] - Core - Add PHAR files to the upload blacklist

Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver...

[20250402] - Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...