761 matches found
[20200703] - Core - CSRF in com_privacy remove-request feature
A missing token check in the remove request section of comprivacy causes a CSRF vulnerability...
[20190201] - Core - Lack of URL filtering in various core components
Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability...
[20180802] - Core - Stored XSS vulnerability in the frontend profile
Inadequate output filtering on the user profile page could lead to a stored XSS attack...
[20210302] - Core - Potential Insecure FOFEncryptRandval
The core shipped but unused randval implementation within FOF FOFEncryptRandval used an potential insecure implemetation. That has now been replaced with a call to "randombytes" and its backport that is shipped within randomcompat...
[20200705] - Core - Escape mod_random_image link
Lack of input filtering and escaping allows XSS attacks in modrandomimage...
[20180505] - Core - XSS Vulnerabilities & additional hardening
Inadequate input filtering leads to multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack...
[20180103] - Core - XSS vulnerability in Uri class
Inadequate input filtering in the Uri class formerly JUri leads to a XSS vulnerability...
Cookie consent from silktide, Unknown version, Other
Cookie consent from silktide, Unknown version, Malicious links aka https://cookieconsent.insites.com/download/ When the Cookie Consent plugin by Silktide stopped using Amazon CDN, someone hijacked their Amazon storage and began serving malicious scripts so that sites that still use old version of...
[20170703] - Core - XSS Vulnerability
Inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components...
Joomla Payage, 2.05, SQL Injection
Joomla Payage, 2.05 and previous, SQL Injection Resolution: update to 2.0.6 Update notice: http://www.lesarbresdesign.info/version-history/payage...
JoomDoc 4.0.3 and previous
JoomDoc 4.0.3 and previous information disclosure resolution: update to 4.0.4 update notice: http://www.artio.net/newsflash/joomdoc-404-release...
Helpdesk Pro by Ossolution Team [com_helpdeskpro], before 1.4.0, multiple vulns
Helpdesk Pro by Ossolution Team comhelpdeskpro, before 1.4.0, multiple vulns Vulnerabilities: Direct Object References Cross-Site Scripting SQL Injection Local file disclosure/Path traversal File Upload Fixed: vulnerability fixed in version 1.4.0 Developer's notice:...
[20150601] - Core - Open Redirect
Inadequate checking of the return value allowed to redirect to an external page...
[20091103] - Core - Front-End Editor Issue
When logged into the front end with Author access, it was possible to replace an article written by another user...
[20090601] - Core - com_users XSS
A XSS vulnerability exists in the user view of comusers in the administrator panel...
[20080801] - Core - Password Remind Functionality
A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user lowest id. Typically, this is an administrator user. Note, that changing the first users username may...
[20260305] - Core - Arbitrary file deletion in com_joomlaupdate
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism...
[20240805] - Core - XSS vectors in Outputfilter::strip* methods
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors...
[20240203] - Core - XSS in media selection fields
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions...
J-BusinessDirectory, 5.7.7 and prior, Other
In the J-BusinessDirectory version 5.8.3 we have updated guzzlehttp to the latest version, 7.5.0 and to PSR 2.1.5...
JCE Pro, 2.8.15, xss
This 2.8.15 an important security update is included to prevent potential cross-site scripting attacks. https://www.joomlacontenteditor.net/news/jce-pro-2-8-15-released...
Easy Discuss 4.1.9 SQL Injection
Easy Discuss 4.1.9 by Stack Ideas, SQL Injection Resolution: update to 4.1.10 update notice: https://stackideas.com/blog/important-security-update-for-easydiscuss4-1-10...
JS support ticket,1.1.5,Directory Traversal
JS support ticket,1.1.5,Directory Traversal resolution: update to 1.1.6 update notice: https://joomsky.com/products/js-ticket-joomla.html...
[20180602] - Core - XSS vulnerability in language switcher module
In some cases the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page url...
[20180503] - Core - Information Disclosure about unpublished tags
Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission...
Easy Discuss, 4.0.20, XSS
Easy Discuss by Stackideas, versions 4.0.20 and previous, XSS Resolution: update to 4.0.21 update notice: https://stackideas.com/blog/easydiscuss4021-update...
[20181004] - Core - ACL Violation in com_users for the admin verification
In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself...
Survey Force Deluxe,3.2.4,SQL Injection
Survey Force Deluxe by Joomplace, 3.2.4, SQL Injection resolution: update to 3.2.5 update notice: https://www.joomplace.com/blog/survey-3-2-5-patch.html...
Vik Rent Items 1.3 and previous
Vik Rent Items 1.3 and previous SQL injection Resolution:update to version 1.4 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...
[20161203] - Core - Information Disclosure
Inadequate ACL checks in the Beez3 comcontent article layout override enables a user to view restricted content...
Breezing Forms Full
Breezing Forms Full before build 884 Information disclosure Resolution: update to latest version Update notice: https://crosstec.org/en/blog/859-breezingforms-medium-security-update.html...
[20120305] - Core - Password Change
Insufficient randomness leads to password reset vulnerability...
adblock detector nordmograph
Malicious script New in 2.1 : Miner feature discontinued This is a security release for the 3.x series of Joomla! This release fixes one low level security issues...
[20210301] - Core - Insecure randomness within 2FA secret generation
Usage of the insecure rand function within the process of generating the 2FA secret.Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...
[20210402] - Core - Inadequate filters on module layout settings
Inadequate filters on module layout settings could lead to an LFI...
[20210303] - Core - XSS within alert messages showed to users
Missing filtering of messages showed to users that could lead to xss issues...
jDownloads,3.2.64,SQL Injection
jDownloads,3.2.64,SQL Injection Developers update http://www.jdownloads.com/index.php/downloads/download/6-jdownloads/2-jdownloads-3-2.htmljd65...
[20190302] - Core - XSS in item_title layout
The itemtitle layout in edit views lacks escaping, leading to a XSS vulnerability...
[20190203] - Core - Additional warning in the Global Configuration textfilter settings
"No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior but might be unexpected for the user. An additional message is now shown in the configuration dialog...
[20190205] - Core - XSS Issue in core.js writeDynaList
Inadequate parameter handling in JS code could lead to an XSS attack vector...
[20181005] - Core - CSRF hardening in com_installer
Added additional CSRF hardening in cominstaller actions in the backend...
Directorix Directory Manager,1.1.1,SQL Injection
Directorix Directory Manager,1.1.1,SQL Injection...
Eventix Events Calendar by Informafix,1.0,SQL Injection
Eventix Events Calendar by Informafix, 1.0, SQL Injection...
[20170402] - Core - XSS Vulnerability
Inadequate filtering leads to XSS in the template manager component...
Yeeditor, abandonware
Yeeditor from Yeedeen development apparently abandoned, developer's site is infected with malware All versions prior to 1.0.7 contain file upload vulnerability...
[20170406] - Core - ACL Violations
Inadequate filtering of form contents lead allow to overwrite the author of an article...
swmenufree, v8.3 ,Other
swmenufree, swMenuFree 8.3 for Joomla 2.5.x and 3.x , other Resolution: update to version 8.5 Update notice: http://www.swmenupro.com/downloads/swmenufree.html?view=document=1...
Solidres previous to 8.0.0
Solidres previous to 8.0.0 SQL Injection Update to 8.0.0 Update notice URL http://www.solidres.com/blog/2015/01/26/solidres-0-8-0-released/...