751 matches found
Coupon manager, 3.5
Coupon manager by joomla6teen.com, 3.5, SQL Injection...
Ajax search for K2, 2.2
Ajax search for K2 by taleia.software, 2.2, SQL Injection...
community quiz,4.4.1,SQL Injection
community quiz by corejoomla.com, 4.4.1, SQL Injection Resolution: update to 4.4.2 Update Notice: https://www.corejoomla.com/news/1164-community-quiz-v4-4-2-is-released.html...
recipe manager, 2.2
recipe manager by joomla6teen.com, 2.2, SQL Injection...
Abstract manager, 2.1
Abstract manager by joomla6teen.com, 2.1, SQL Injection...
guesser, 1.0.4
guesser by bitsgeo.com, 1.0.4, SQL Injection...
One Vote,1.1.1,SQL Injection
One Vote by advcomsys.com, 1.1.1 and previous, SQL Injection resolution: update to 1.2.2 update notice: http://www.advcomsys.com/joomla-demos...
[20170407] - Core - ACL Violations
Inadequate mime type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden...
GPS Tools v4.0.1,4.0.1,SQL Injection
GPS Tools v4.0.1,4.0.1,SQL Injection Developer release statement to the vel team https://www.corejoomla.com/news/1163-gps-tools-v4-0-2-is-released.html...
[20170404] - Core - XSS Vulnerability
Inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components...
JomWall, 4.1.1,SQL Injection
JomWall version 4.1.1 and previous, SQL Injection resolution: update to 4.1.2 update notice: https://dashbite.com/news/jomwall-security-fix-new-version-4-1-2...
Joomloc-CAT, version 4.1.3, SQL injection
Joomloc-CAT, version 4.1.3, SQL injection Resolution: update to 4.2.1 Update Notice URL http://www.joomloc.fr.nf/en/downloads-products/file/joomloc-pro-channel-manager-pms.html...
JE Property Finder, 1.6.3
JE Property Finder,1.6.3,SQL Injection...
Jtag Calendar 6.2.4
JTag Calendar versions 6.2.4 and previous Resolution: update to 6.2.5 Developer states: Fixed security issue in search functionality Update notice: https://joomlatag.com/premium-joomla-extensions/jtag-calendar-detail.html...
hwdVideoShare,N/A
hwdVideoShare,N/A,SQL Injection Dev Statement The hwdVideoShare comhwdvideoshare extension was retired 3 years ago, and we deleted it from the Joomla Extensions Directory. It was replaced by a completely new extension called HWDMediaShare...
Joomla Spider FAQ by Web-Dorado pre 1.3
Joomla Spider FAQ by Web-Dorado pre 1.3 ,SQLi Update to 1.3...
kunena,4.0.10,Information Disclosure
kunena,4.0.10,Information Disclosure Developers update link https://www.kunena.org/blog/166-kunena-4-0-11-released...
Community Builder versions 2.1 and previous
Community Builder Versions 2.1.0 and previous contain versions of 3rd party libraries with known vulnerabilities: PHPMailer and Guzzle Release 2.1.1 updates to version 5.2.22 of PHP Mailer provides custom fix for Guzzle library Developer states that this is precautionary only, and that these...
joomunited SEO Glossary ,pre 2.2.4,Other
joomunited SEO Glossary , pre 2.2.4,Other Developer statement in mass email to registered users We just fixed an SEO Glossary vulnerability, an update to version 2.2.4 is required as soon as possible. https://www.joomunited.com/changelog/seo-glossary-changelog Fix informed by user...
Huge IT gallery,1.1.5,SQL Injection
Huge IT gallery,1.1.5,SQL Injection resolution: update to 1.1.9...
Virtuemart 3.0.10 and previous
XSS Resolution: update to 3.0.12 or 2.6.22 for VM2 users Update notice: http://virtuemart.net/news/latest-news/473-security-release-virtuemart-3-0-12 Note that developer did not inform the VEL...
Easy Youtube Gallery , 1.0.2,Information Disclosure
Easy Youtube Gallery , 1.0.2,Information Disclosure...
RSMonials,2.2 and previous,XSS (Cross Site Scripting)
RSMonials, 2.2 and previous versions, XSS Cross Site Scripting also insecure file upload...
Kunena, 5.0.2 and newer, XSS (Cross Site Scripting)
Kunena,5.0.2 and newer,XSS Cross Site Scripting resolutiion: update to 5.0.5 update notice: https://www.kunena.org/forum/announcement/id-107...
[20170401] - Core - Information Disclosure
Mail sent using the JMail API leaked the used PHPMailer version in the mail headers...
Jomres 9.8.22 and previous PHPMailer vulnerability
Jomres versions 9.8.20 and previous contain PHP Mailer library vulnerable to CVE-2016-10033 Jomres versions 9.8.22 and previous contain PHP Mailer library vulnerable to CVE-2016-10045 Resolution: update to version 9.8.24 Update notice: http://updates.jomres4.net/CHANGELOGJOMRES...
Chronoforms 5.0.13 PHP mailer vulnerability
Chronoforms 5.0.13 and previous versions include PHP Mailer library vulnerable to CVE-2016-10045 Resolution: update to 5.0.14 Update notice: https://www.chronoengine.com/forums/posts/t102804/p363944/phpmailer-library.html...
AcyMailing 5.6.0 PHP Mailer vulnerability
AcyMailing 5.6.0 and previous versions include PHP Mailer library vulnerable to CVE-2016-10033 and CVE-2016-10045 Resolution: update to 5.6.1 Update notice: https://www.acyba.com/68-acymailing-changelog.html...
JMS Support Online module, 2.0.0, XSS (Cross Site Scripting)
JMS Support Online module,2.0.0,XSS Cross Site Scripting...
Chronoforms 5.0.12 PHP mailer vulnerability
Chronoforms 5.0.12 and previous versions include PHP Mailer library vulnerable to CVE-2016-10033 Resolution: update to 5.0.13 Update notice: https://www.chronoengine.com/forums/posts/t102804/p363944/phpmailer-library.html...
[20170402] - Core - XSS Vulnerability
Inadequate filtering leads to XSS in the template manager component...
aWeb Cart Watching System 2.6.0
aWeb Cart Watching System for Virtuemart versions 2.6.0 and previous SQL injection Resolution: update to 2.6.1 Update Notice: http://awebsupport.com/...
DT Register, sql/xss, 3.1.12 / 2.8.18 and previous
DT Register Vulnerable version: 3.1.12 / 2.8.18 and previous sql/xss http://www.dthdevelopment.com/dth-news/dt-register-3.1.13-security-release.html http://www.dthdevelopment.com/joomla-components/dt-register-event-registration-for-joomla.html developer did not inform VEL...
AVChat Video Chat Integration Kit, File permissions
AVChat Video Chat Integration Kit, File permissions...
JS Jobs,1.1.5 and all previous,SQL Injection
JS Jobs,1.1.5 and all previous,SQL Injection Resolution: update to version 1.1.6 Update notice: https://www.joomsky.com/products/js-jobs.htmlfive...
[20161205] - PHPMailer Security Advisory
All versions of the third-party PHPMailer library distributed with Joomla! versions up to 3.6.5 are vulnerable to a remote code execution vulnerability. This is patched in PHPMailer 5.2.20 which will be included with Joomla! 3.7. After analysis, the JSST has determined that through correct use of...
[20161204] - Misc. Security Hardening
Joomla! 3.6.5 includes additional security hardening mechanisms prepared by the JSST, thanks in part to issue reports from Fotis Evangelou and Nicholas Dionysopoulos, which restricts a user's ability to make potentially damaging configuration changes. This includes restricting the ability to set...
Kunena,K4.0.0 - K5.0.3,XSS (Cross Site Scripting)
Kunena,K4.0.0 - K5.0.3,XSS Cross Site Scripting Resolution: update to 5.0.4 update notice:https://www.kunena.org/blog/179-kunena-5-0-4-released...
JoomDoc 4.0.3 and previous
JoomDoc 4.0.3 and previous information disclosure resolution: update to 4.0.4 update notice: http://www.artio.net/newsflash/joomdoc-404-release...
[20161201] - Core - Elevated Privileges
Incorrect use of unfiltered data stored to the session on a form validation failure allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments...
[20161202] - Core - Shell Upload
Inadequate filesystem checks allowed files with alternative PHP file extensions to be uploaded...
[20161003] - Core - Account Modifications
Incorrect use of unfiltered data allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments...
HDW Player, 3.2.1 and older
HDW Player, 3.2.1 and older including 3.1 and 3.0 Remote code execution Please see https://vel.joomla.org/vel-blog/2033-hdw-player-4-0-0-rce for further information...
[20161002] - Core - Elevated Privileges
Incorrect use of unfiltered data allows for users to register on a site with elevated privileges...
ja-k2- filter-and- search, SQL Injection
ja-k2- filter-and- search, version 1.2.2 and all previous SQL Injection Resolution: update to 1.2.5 Update notice: https://www.joomlart.com/updates/joomla-extensions/important-security-fix-release-ja-k2-filter-component?utmsource=newslettermedium=emailcampaign=k2filtercritical Note that developer...
[20161001] - Core - Account Creation
Inadequate checks allows for users to register on a site when registration has been disabled...
Huge IT Slider,1.0.9,SQL Injection
Huge IT Slider,1.0.9,SQL Injection Resolution: update to 1.1.0 update notice: https://huge-it.com/joomla-extensions-security-notice/...
Huge IT Googlemaps,1.0.9,SQL Injection
Huge IT Googlemaps,1.0.9, Multiple SQL Injection vulnerabilities...
Huge IT Video Gallery,1.1.1,XSS (Cross Site Scripting)
Huge IT Video Gallery,1.1.1,XSS Cross Site Scripting Also versions 1.0.9 and previous have SQL injection vulnerability Resolution: update to version 1.1.3 Update notice: https://huge-it.com/joomla-extensions-security-notice/...