761 matches found
JSP Store Locator, 2.4, SQL Injection
JSP Store Locator by Joomla Service Provider, versions 2.4 and previous, SQL Injection Resolution: update to 2.5 update notice: http://www.joomlaserviceprovider.com/jspblog/jsp-store-locator-2-5-security-release.html...
[20180505] - Core - XSS Vulnerabilities & additional hardening
Inadequate input filtering leads to multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack...
[20170901] - Core - Information Disclosure
A logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...
[20170703] - Core - XSS Vulnerability
Inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components...
[20090302] - Core - com_content XSS
A XSS vulnerability exists in the category view of comcontent...
chronoforms
A new update is now available: https://www.chronoengine.com/downloads/chronoforms/chronoforms-v8/chronoforms-v8-joomla-extension The affected range should be any version before v8.0.53 Best regards, Max & the ChronoEngine.com Team...
[20240805] - Core - XSS vectors in Outputfilter::strip* methods
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors...
[20240802] - Core - Cache Poisoning in Pagination
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors...
[20210307] - Core - ACL violation within com_content frontend editing
Incorrect ACL checks could allow unauthorized change of the category for an article...
[20200705] - Core - Escape mod_random_image link
Lack of input filtering and escaping allows XSS attacks in modrandomimage...
[20200703] - Core - CSRF in com_privacy remove-request feature
A missing token check in the remove request section of comprivacy causes a CSRF vulnerability...
[20190302] - Core - XSS in item_title layout
The itemtitle layout in edit views lacks escaping, leading to a XSS vulnerability...
[20180503] - Core - Information Disclosure about unpublished tags
Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission...
[20181004] - Core - ACL Violation in com_users for the admin verification
In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself...
[20180103] - Core - XSS vulnerability in Uri class
Inadequate input filtering in the Uri class formerly JUri leads to a XSS vulnerability...
[20170406] - Core - ACL Violations
Inadequate filtering of form contents lead allow to overwrite the author of an article...
[20090601] - Core - com_users XSS
A XSS vulnerability exists in the user view of comusers in the administrator panel...
HikaShop Joomla Plugin, , SQL Injection
anyone with access to the order management in the backend of HikaShop to be able to use a MySQL injection to extract data from the database. "payment methods" restriction setting to custom fields of the "order" table in HikaShop 4.4.1, so prior versions of HikaShop are not impacted...
adblock detector nordmograph
Malicious script New in 2.1 : Miner feature discontinued This is a security release for the 3.x series of Joomla! This release fixes one low level security issues...
[20210301] - Core - Insecure randomness within 2FA secret generation
Usage of the insecure rand function within the process of generating the 2FA secret.Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...
JCE Pro, 2.8.15, xss
This 2.8.15 an important security update is included to prevent potential cross-site scripting attacks. https://www.joomlacontenteditor.net/news/jce-pro-2-8-15-released...
[20210303] - Core - XSS within alert messages showed to users
Missing filtering of messages showed to users that could lead to xss issues...
[20190204] - Core - Stored XSS issue in the Global Configuration help url #2
Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS...
[20190205] - Core - XSS Issue in core.js writeDynaList
Inadequate parameter handling in JS code could lead to an XSS attack vector...
Joomla Payage, 2.05, SQL Injection
Joomla Payage, 2.05 and previous, SQL Injection Resolution: update to 2.0.6 Update notice: http://www.lesarbresdesign.info/version-history/payage...
[20170402] - Core - XSS Vulnerability
Inadequate filtering leads to XSS in the template manager component...
Breezing Forms Full
Breezing Forms Full before build 884 Information disclosure Resolution: update to latest version Update notice: https://crosstec.org/en/blog/859-breezingforms-medium-security-update.html...
Resize Image On The Fly and Cache 1.1.0 and previous
Resize Image On The Fly and Cache - content plugin by s2software.it Version 1.1.0 and likely all previous Open folder permissions Resolution: update to version 1.3.3 Existing users will need to manually fix the permissions of folder /images/cache to 755 or delete it in order to be recreated by th...
Helpdesk Pro by Ossolution Team [com_helpdeskpro], before 1.4.0, multiple vulns
Helpdesk Pro by Ossolution Team comhelpdeskpro, before 1.4.0, multiple vulns Vulnerabilities: Direct Object References Cross-Site Scripting SQL Injection Local file disclosure/Path traversal File Upload Fixed: vulnerability fixed in version 1.4.0 Developer's notice:...
[20260516] - Core - Incorrect Access Control in com_scheduler
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks...
[20260509] - Core - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability...
[20240702] - Core - Self-XSS in fancyselect list field layout
The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector...
[20190203] - Core - Additional warning in the Global Configuration textfilter settings
"No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior but might be unexpected for the user. An additional message is now shown in the configuration dialog...
Easy Discuss, 4.0.20, XSS
Easy Discuss by Stackideas, versions 4.0.20 and previous, XSS Resolution: update to 4.0.21 update notice: https://stackideas.com/blog/easydiscuss4021-update...
Cookie consent from silktide, Unknown version, Other
Cookie consent from silktide, Unknown version, Malicious links aka https://cookieconsent.insites.com/download/ When the Cookie Consent plugin by Silktide stopped using Amazon CDN, someone hijacked their Amazon storage and began serving malicious scripts so that sites that still use old version of...
JoomDoc 4.0.3 and previous
JoomDoc 4.0.3 and previous information disclosure resolution: update to 4.0.4 update notice: http://www.artio.net/newsflash/joomdoc-404-release...
[20150601] - Core - Open Redirect
Inadequate checking of the return value allowed to redirect to an external page...
[20120305] - Core - Password Change
Insufficient randomness leads to password reset vulnerability...
[20091103] - Core - Front-End Editor Issue
When logged into the front end with Author access, it was possible to replace an article written by another user...
[20080801] - Core - Password Remind Functionality
A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user lowest id. Typically, this is an administrator user. Note, that changing the first users username may...
[20260514] - Core - Privilege escalation through com_users webservice endpoints
An improper access check allows privelege escalation through the comusers group editing webservice endpoint...
[20230501] - Core - Open Redirects and XSS within the mfa selection
Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen...
J-BusinessDirectory, 5.7.7 and prior, Other
In the J-BusinessDirectory version 5.8.3 we have updated guzzlehttp to the latest version, 7.5.0 and to PSR 2.1.5...
[20210402] - Core - Inadequate filters on module layout settings
Inadequate filters on module layout settings could lead to an LFI...
[20220303] - Core - User row are not bound to a authentication mechanism
A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover...
jDownloads,3.2.64,SQL Injection
jDownloads,3.2.64,SQL Injection Developers update http://www.jdownloads.com/index.php/downloads/download/6-jdownloads/2-jdownloads-3-2.htmljd65...
Easy Discuss 4.1.9 SQL Injection
Easy Discuss 4.1.9 by Stack Ideas, SQL Injection Resolution: update to 4.1.10 update notice: https://stackideas.com/blog/important-security-update-for-easydiscuss4-1-10...
JS support ticket,1.1.5,Directory Traversal
JS support ticket,1.1.5,Directory Traversal resolution: update to 1.1.6 update notice: https://joomsky.com/products/js-ticket-joomla.html...