761 matches found
[20180508] - Core - Possible XSS attack in the redirect method
Under specific circumstances a redirect issued with a URI containing a username and password when the Location: header cannot be used, a lack of escaping the user-info component of the URI could result in a XSS vulnerability...
[20180502] - Core - Add PHAR files to the upload blacklist
Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver...
[20180102] - Core - XSS vulnerability in com_fields
Inadequate input filtering in comfields leads to a XSS vulnerability in multiple field types, i.e. list, radio and checkbox...
[20100423] - Core - Installer Migration Script
The migration script in the Joomla! installer does not check the file type being uploaded. If the installation application is present, an attacker could use it to upload malicious files to a server...
[20210308] - Core - Path Traversal within joomla/archive zip class
Extracting an specifilcy crafted zip package could write files outside of the intended path...
[20210101] - Core - com_modules exposes module names
Lack of ACL checks in the orderPosition endpoint of commodules leak names of unpublished and/or inaccessible modules...
[20210305] - Core - Input validation within the template manager
Missing input validation within the template manager...
[20210306] - Core - com_media allowed paths that are not intended for image uploads
commedia allowed paths that are not intended for image uploads...
[20190701] - Core - Filter attribute in subform fields allows remote code execution
Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option...
[20190301] - Core - XSS in com_config JSON handler
The JSON handler in comconfig lacks input validation, leading to XSS vulnerability...
[20180801] - Core - Hardening the InputFilter for PHAR stubs
Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter...
SP Movie Database 1.3, SQL Injection
SP Movie Database version 1.3 by joomshaper.com, SQL Injection resolution: update to version 1.4 update notice: https://www.joomshaper.com/forums/sp-movie-database-component-updated-with-security-and-other-fixes...
[20170702] - Core - XSS Vulnerability
Missing CSRF token checks and improper input validation lead to an XSS vulnerability...
[20250402] - Core - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
[20250401] - Framework - SQL injection vulnerability in quoteNameStr method of Database package
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package...
[20240703] - Core - XSS in StringHelper::truncate method
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method...
[20201106] - Core - CSRF in com_privacy emailexport feature
A missing token check in the emailexport feature of comprivacy causes a CSRF vulnerability...
[20200102] - Core - CSRF com_templates LESS compiler
A missing CSRF token check in the LESS compiler of comtemplates causes a CSRF vulnerability...
[20180803] - Core - ACL Violation in custom fields
Inadequate checks regarding disabled fields can lead to an ACL violation...
[20170404] - Core - XSS Vulnerability
Inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components...
[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'
Multiple Full Path Disclosures because of missing 'JEXEC or die check' caused by the PSR12 changes done in 4.2.0. According to PROD2020/023 and in coordination with the JSST this has been patched in the public tracker vis 38615...
[20220307] - Core - Variable Tampering on JInput $_REQUEST data
Under specific circumstances, JInput pollutes method-specific input bags with $REQUEST data...
[20220309] - Core - XSS attack vector through SVG
Possible XSS attack vector through SVG embedding in commedia...
[20210401] - Core - Escape xss in logo parameter error pages
Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error pages...
[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field
Inadequate filtering of form contents could allow to overwrite the author field. The affected core components are comfields, comcategories, combanners, comcontact, comnewsfeeds and comtags...
ZOO by YOOtheme,3.3.33,SQL Injection
ZOO by YOOtheme,3.3.33,SQL Injection Fix SQL injection vulnerability in Admin Controllers new version number 3.3.34 Update Notice URL https://yootheme.com/support/zoo/changelog...
[20190206] - Core - Implement the TYPO3 PHAR stream wrapper
The phar:// stream wrapper can be used for objection injection attacks. We now disallow usage of the phar:// handler for non .phar-files within the CMS globally by implementing the TYPO3 PHAR stream wrapper...
[20190101] - Core - Stored XSS in mod_banners
Inadequate escaping in modbanners leads to a stored XSS vulnerability...
Twitch Tv 1.1, SQL Injection
Twitch TV version 1.1 by Bharat Koriya aindropsinfotech.com, SQL Injection...
J-Business Directory by CMS Junkie, 4.6.8, SQL Injection
J-Business Directory by CMS Junkie, 4.6.8, SQL Injection Resolution: update to 4.7.3 Update Notice URL: http://www.cmsjunkie.com/blog/cat/news-joomla-business-directory/post/joomlabusinessdirectory4-7-3release...
[20111102] - Core - Password Change
Weak random number generation during password reset leads to possibility of changing a user's password...
[20200702] - Core - Missing checks can lead to a broken usergroups table record
Missing validation checks at the usergroups table object can result into an broken site configuration...
[20190104] - Core - Stored XSS issue in the Global Configuration help url
Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS...
JSP Store Locator, 2.4, SQL Injection
JSP Store Locator by Joomla Service Provider, versions 2.4 and previous, SQL Injection Resolution: update to 2.5 update notice: http://www.joomlaserviceprovider.com/jspblog/jsp-store-locator-2-5-security-release.html...
[20180101] - Core - XSS vulnerability in module chromes
Lack of escaping in the module chromes leads to XSS vulnerabilities in the module system...
Vik Appointments 1.4 and previous
Vik Appointments 1.4 and previous, SQL Injection Resolution: update to 1.5 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...
Resize Image On The Fly and Cache 1.1.0 and previous
Resize Image On The Fly and Cache - content plugin by s2software.it Version 1.1.0 and likely all previous Open folder permissions Resolution: update to version 1.3.3 Existing users will need to manually fix the permissions of folder /images/cache to 755 or delete it in order to be recreated by th...
[20120301] - Core - SQL Injection
Inadequate escaping leads to SQL injection vulnerability...
[20240201] - Core - Insufficient session expiration in MFA management views
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...
JoomGallery, 3.6.1, SQL Injection
Vulnerability Type: 3rd party extension - SQL Injection Version: Old 3.6.1 / New 3.6.2 Update details: Fix vulnerability type SQL Injection. Update URL: https://www.en.joomgalleryfriends.net/news-3-6-2.html Changelog URL:...
[20221001] - Core - Disclosure of critical information in debug mode
Joomla 4 sites with publicly enabled debug mode exposed data of previous requests...
[20190304] - Core - Missing ACL check in sample data plugins
The sample data plugins lack ACL checks, allowing unauthorized access...
[20171101] - Core - LDAP Information Disclosure
Inadequate escaping in the LDAP authentication plugin can result in disclosure of username and password...
[20170901] - Core - Information Disclosure
A logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...
[20100423] - Core - Password Reset Tokens
When a user requests a password reset, the reset tokens were stored in plain text in the database. While this is not a vulnerability in itself, it allows user accounts to be compromised if there is an extension on the site with an SQL injection vulnerability...
[20090302] - Core - com_content XSS
A XSS vulnerability exists in the category view of comcontent...
[20221101] - Core - RXSS through reflection of user input in com_media
Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in commedia...
[20210307] - Core - ACL violation within com_content frontend editing
Incorrect ACL checks could allow unauthorized change of the category for an article...
[20200706] - Core - System Information screen could expose redis or proxy credentials
Inadequate filtering in the system information screen could expose redis or proxy credentials...