J-BusinessDirectory 4.5.4 and previous

J-BusinessDirectory 4.5.4 and previous sql injection resolution: update to 4.5.5 update notice: http://www.cmsjunkie.com/blog/joomlabusinessdirectory4-5-5release/...

Event Registration Pro,3.2.12 - 3.2.10,SQL Injection

Event Registration Pro,3.2.12 - 3.2.10,SQL Injection resolution: update to 3.2.13 update notice: https://www.joomlashowroom.com/blog/event-registration-pro-3-2-13-released-security-release...

aceftp,unknown version,Other

aceftp abandonware,unknown, Download Permssion Extension not currently under development, probably all versions affected...

Huge IT Catalog,1.0.6,SQL Injection

Huge IT Catalog,1.0.6 and previous versions ,SQL Injection and XSS vulnerability Resolution: update to 1.0.8 Update notice: https://huge-it.com/joomla-extensions-security-notice/...

nitroslider,1.0.0

nitroslider,1.0.0 open folder permissions update to 1.0.1 update notice: https://www.themechoice.com/joomla-extensions/nitro-layer-slider...

K2,2.7.0,XSS (Cross Site Scripting)

K2,2.7.0,XSS Cross Site Scripting resolution: update to 2.7.1 update notice url: https://getk2.org/blog/2571-k2-v271-released Note that the VEL do not agree with the developer's assessment that XSS vulnerability is low priority...

Payplans SQLi

SQL Injection In PayPlans. readybytes developer update notice. http://www.readybytes.net/blog/item/payplans-sql-injection-blog.html Community notified report...

[20160803] - Core - CSRF

Add additional CSRF hardening in comjoomlaupdate...

Universal AJAX Live Search, 5.4.0, Other

Universal AJAX Live Search 5.4.0, Other. Inadequate permissions Developer states: Extension Update Details Folders permissions vulnerability fixed. Resolution: update to versio 5.4.2 UpdateNoticeURL http://universalajaxlivesearch.demo.offlajn.com/index.php/simple-theme/security-update...

SecurityCheck and SecurityCheck Pro Vulnerable Versions: 2.8.9

Stored XSS and SQL Injection in SecurityCheck and SecurityCheck Pro Vulnerable Versions: 2.8.9 possibly below resolution: update to version 2.8.10 update notice: https://securitycheck.protegetuordenador.com/index.php/downloads/securitycheck-j3x...

mod fancy tag cloud,1.017,Other

mod fancy tag cloud comofflajninstaller,1.017,Other resolution: update to version 1.020 update notice: http://fancytagcloud.demo.offlajn.com/index.php/security-update existing users may also need to fix folder permissions, please contact the developer for further information...

Yeeditor, abandonware

Yeeditor from Yeedeen development apparently abandoned, developer's site is infected with malware All versions prior to 1.0.7 contain file upload vulnerability...

[20170406] - Core - ACL Violations

Inadequate filtering of form contents lead allow to overwrite the author of an article...

[20160801] - Core - ACL Violation

Inadequate ACL checks in comcontent provide potential read access to data which should be access restricted to users with editown level...

Komento 2.0.6, xss

We just released Komento 2.0.7 to address a security issue where a remote attacker may be able to launch an xss attack in prior versions of Komento. update notice: https://stackideas.com/blog/important-komento-2-0-7-security-fix...

gmapfp,3.39f,XSS (Cross Site Scripting)

gmapfp,3.39f and previos,XSS Cross Site Scripting Info disclosure, arbitrary fileupload resolution: update to J3.41F update notice:http://gmapfp.org/en/news-of-gmapfp/39-strengthening-of-the-security-component...

[20161203] - Core - Information Disclosure

Inadequate ACL checks in the Beez3 comcontent article layout override enables a user to view restricted content...

User Group FTW For Hikashop,1.1.5,Other

User Group FTW For Hikashop, 1.1.5, Other...

JSN Power Admin,2.3.0,XSS (Cross Site Scripting)

JSN Power Admin,2.3.0, XSS Cross Site Scripting Resolution: update to 2.3.2 Update notice: http://www.joomlashine.com/knowledgeportal/articles/jsn-poweradmin-vulnerability-problem-solved.html Note that previous security release 2.3.1 is still vulnerable, and should be updated...

Breezing Forms Lite

Breezing Forms Lite before build 912 Information disclosure Resolution: update to latest version Update notice: https://crosstec.org/en/blog/859-breezingforms-medium-security-update.html...

Spider random articles before 1.5.3

Spider random articles versions before 1.5.3 Resolution: update to 1.5.3 Update notice: https://web-dorado.com/products/joomla-random.html...

Breezing Forms Full

Breezing Forms Full before build 884 Information disclosure Resolution: update to latest version Update notice: https://crosstec.org/en/blog/859-breezingforms-medium-security-update.html...

Form Maker before 3.6.0

Web Dorado Form Maker versions before 3.6.0 XSS Resolution: update to 3.6.0 Update notice: https://web-dorado.com/products/joomla-form.html...

[20170405] - Core - XSS Vulnerability

Inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component...

[20170408] - Core - Information Disclosure

Multiple files caused full path disclosures on systems with enabled error reporting...

[20170701] - Core - Information Disclosure

Improper cache invalidation leads to disclosure of form contents...

[20160802] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in mail component...

EasySocial versions before 1.4.7

EasySocial versions before 1.4.7: Code injection Resolution: update to 1.4.7 Update notice: http://stackideas.com/blog/critical-update-for-easysocial-update-to-1-4-7-now...

Joom Donation, versions before 4.1, Information Disclosure

Joomdonation extensions, Information Disclosure Joom Donation versions before 4.1 Resolution: update to 4.1 Update notice URL: http://joomdonation.com/forum/joom-donation/50513-joom-donation-version-4-1-released.html...

Eshop, versions before 1.4.4

Joomdonation extensions, Information Disclosure Eshop versions before 1.4.4 Resolution: update to 1.4.4 Update notice URL: http://joomdonation.com/forum/released-versions/50510-eshop-1-4-4-was-released-at-december-25-2015.html73480...

Events Booking, versions before 2.1.1

Joomdonation extensions, Information Disclosure Events Booking versions before 2.1.1 Resolution: update to 2.1.1 Update notice URL: http://joomdonation.com/forum/events-booking-general-discussion/50511-events-booking-version-2-1-1-released.html...

Memberhsip Pro, versions before 2.1.1

Joomdonation extensions, Information Disclosure Memberhsip Pro versions before 2.1.1 Resolution: update to 2.1.1 Update notice URL: http://joomdonation.com/forum/membership-pro/50512-membership-pro-version-2-1-1-released.html...

Payment Form, versions before 4.2

Joomdonation extensions, Information Disclosure Payment Form versions before 4.2 Resolution: update to 4.2 Update notice URL: http://joomdonation.com/forum/payment-form/50514-payment-form-version-4-2-released.html...

[20151206] - Core - Session Hardening

The Joomla Security Strike team has been following up on the critical security vulnerability patched last week. Since the recent update it has become clear that the root cause is a bug in PHP itself. This was fixed by PHP in September of 2015 with the releases of PHP 5.4.45, 5.5.29, 5.6.13 Note...

[20151207] - Core - SQL Injection

Inadequate filtering of request data leads to a SQL Injection vulnerability...

[20151205] - Session - Remote Code Execution Vulnerability

Browser information is not filtered properly while saving the session values which leads to a Remote Code Execution vulnerability...

[20151201] - Core - Remote Code Execution Vulnerability

Browser information is not filtered properly while saving the session values into the database which leads to a Remote Code Execution vulnerability...

Resize Image On The Fly and Cache 1.1.0 and previous

Resize Image On The Fly and Cache - content plugin by s2software.it Version 1.1.0 and likely all previous Open folder permissions Resolution: update to version 1.3.3 Existing users will need to manually fix the permissions of folder /images/cache to 755 or delete it in order to be recreated by th...

[20151202] - Core - CSRF Hardening

Add additional CSRF hardening in comtemplates...

[20151203] - Core - Directory Traversal

Failure to properly sanitise input data from the XML install file located within an extension's package archive allows for directory traversal...

[20151204] - Core - Directory Traversal

Inadequate filtering of request data leads to a Directory Traversal vulnerability...

JNews,8.5.1,SQL Injection

JNews, 8.5.1 and all previous, SQL Injection Resolution: update to 8.7.1 Update notice url: http://www.joobi.co/blog/jnews-8-7-released.html Note that due to discrepancy in developer's code between package and repository, some versions of previous security release 8.6.1 are still vulnerable...

cckseblod 1.x Directory Traversal

comcckseblod aka seblod 1.x for Joomla 1.5 1.9.0 and all previous versions Directory Traversal Resolution: update to 1.9.1 Update notice: http://www.seblod.com/changelogs?sebchangelogproduct=cck1x Developer states that Seblod 3.x, the version compatible with Joomla 2.5 and 3, is not vulnerable...

Realtyna RPL,8.9.2,Other

Realtyna RPL,8.9.2,Other Resolution: update to 8.9.5 Update notice URL http://rpl.realtyna.com/Change-Logs/RPL7-Changelog...

[20151001] - Core - SQL Injection

Inadequate filtering of request data leads to a SQL Injection vulnerability...

[20151002] - Core - ACL Violations

Inadequate ACL checks in comcontenthistory provide potential read access to data which should be access restricted...

Komento, 2.0.4 and previous, XSS (Cross Site Scripting)

Stackideas Komento, prior to 2.0.5, XSS Cross Site Scripting Resolved in version 2.0.5 Update notice: http://stackideas.com/changelog/komento?version=2.0.5...

Extplorer, 2.1.7 and previous

Developer startement eXtplorer 2.1.8 released Today eXtplorer 2.1.8 was released, fixing some minor vulnerabilities. Changelog: - added security functions for protection against CSRF attacks - fixed "directories with the name '0' are not loading" An update is recommended...

Master User, versions before 2.1.4

Versions before 2.1.4 suffered from an issue with insecure default settings, the issue affects Joomla 3.4 sites only, but users are advised by the developer to update anyway. Resolution: Update to version 2.1.4 Update notice URL:...

JEvents, pre 3.2.20

Extension: JEvents from jevents.net Vulnerability: SQL injection Versions affected prior to 3.2.20 Resolution: update to 3.2.20 - JEvents 3.4.0RC6 is also available for Joomla 3.4+ which fixes the same security issue. Update notice URL: https://www.jevents.net/component/zoo/item/jevents-33...