751 matches found
JCE - Joomla Content Editor 2.4.5 and previous
Versions 2.4.5 and previous Update to Version 2.4.6 improves security in add-on installation system UpdateNoticeURL https://www.joomlacontenteditor.net/news/item/jce-246-released...
corephp paGo, LFI 1.0.7 and below
Corephp paGo, , DT, LFI Developer update statement http://www.corephp.com/blog/corephp-announces-immediate-availability-pago-commerce-1-07-1/...
EDVAS blank template pre 3.5.1
Blank bootstrap edition Template : Update Details http://github.com/Bloggerschmidt/Blank-Bootstrap-Edition/releases/tag/v3.5.1 See https://github.com/Bloggerschmidt/Blank-BootstrapEdition...
sbahjaoui contact 1.0
sbahjaoui contact version 1.0 SQL Injection Resolution: update to version 1.1 Update notice: http://www.sbahjaoui-info.com/en/extensions/category/10-sbahjaoui-contact.html ttweetfsubscribe...
Visforms pre 2.1.2 and pre 3.1.2
Update so that information submitted with Visforms cannot be disclosed unintentionally. http://www.vi-solutions.de/en/announcements/366-security-updates-for-visforms-2-1-2-and-3-1-2-released...
HDFLVPlayer 2.2 + previous
Joomla HDFLVPlayer plugin versions 2.2 and previous SQL Injection Version 2.3 Fixed SQL injection in download.php file.https://www.apptha.com/category/extension/Joomla/HD-FLV-Player Version 2.2 Resolved cross domain issue in download.php & email.php files...
HDFLVPlayer 2.2 and previous
HDFLVPlayer versions 2.2 and all previous Email exploit Version 2.3 Fixed SQL injection in download.php file.https://www.apptha.com/category/extension/Joomla/HD-FLV-Player Version 2.2 Resolved cross domain issue in download.php & email.php files...
failedloginattempts v1.0.1
plgfailedloginattemptsv1.0.1j25j30, 1.0.1, Information Disclosure Developers update statements 12-Dec-2014 : v1.1.0 http://www.web357.eu/news/releases/68-failed-login-attempts-v1-1-0-has-been-released-security-release.html...
Events Booking, 1.6.7 and lower, (module: Search Events)
Events Booking 1.6.7 =Vulnerability: XSS Cross Site Scripting Extension Update Details This issue only affect the search module Search Events which comes with Events Booking. We released version 1.6.8 to address this issue...
HDFLVPlayer, 2.0, Directory Traversal
HDFLVPlayer, 2.0, Directory Traversal Contus/apptha developers statement We fixed the directory traversal issue and updated the version with 2.2 UpdateNoticeURL http://www.hdflvplayer.net/hd-flv-player-download.php...
edocuman, 1.6.0, Other
edocuman, 1.6.0, Other Developer update notice http://joomdonation.com/forum/edocman/45095-low-security-edocman-1-6-1-released.html53433...
Admin Exile 2.3.5 sqli
Admin Exile version 2.3.5 SQL injection Developer Update Version 2.3.6 resolves an unpublished/theoretical SQL injection vulnerability. http://www.richeyweb.com/development/joomla-plugins/71-adminexile-for-joomla-16...
AceShop, up to version 4.1.3,
AceShop, up to version 4.1.3, SQL Injection...
MijoShop, 2.4.x - 2.5.x,
MijoShop, 2.4.x - 2.5.x, SQL Injection Extension Update Details 2.5.2 UpdateNoticeURL http://miwisoft.com/blog/mijoshop-252-security-update-released...
Akeeba CMS Update
Extension Update Details Akeeba CMS Update 1.0.2 Update Notice URL https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html...
Hika Shop
HikaShop 2.3.2 and below also Hika Market 1.4.3 and below Remote code execution Note that developer did not inform the VEL Notice of resolution: http://www.hikashop.com/index.php?option=comcontent=article=269...
JDownloads
unauthorized file upload vulnerable versions: below 1.9.1.6 Joomla 2.5 and below 1.9.2.11 Joomla 3 security release announcement: http://www.jdownloads.com/index.php?option=comcontent=article=231:urgent-security-update-for-19-series=51:news Note that the developer did not inform the VEL...
[20140904] - Core - Denial of Service
Inadequate checking allowed the potential for a denial of service attack...
[20140903] - Core - Remote File Inclusion
Inadequate checking allowed the potential for remote files to be executed...
Joomla Mac Gallery 1.5 and below
Joomla Mac Gallery 1.5 and below RFI...
AceSEF , 4.1.2 and below
AceSEF , 4.1.2, SQL Injection...
EuropaCart, 8.0.1 and below ,
EuropaCart, 8.0.1, Other - ACL @Kryptronic...
Spider Contacts 1.3.6 SQLI
Joomla Spider Contacts 1.3.6 SQL Injection Developer update http://web-dorado.com/products/joomla-contacts.html...
[20140902] - Core - Unauthorised Logins
Inadequate checking allowed unauthorised logins via LDAP authentication...
joomla spider video, 2.8.3, sqli
joomla spider video, 2.8.3, SQL Injection UpdateNoticeURL http://web-dorado.com/products/joomla-player.html...
[20140901] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in commedia...
Akeeba backup
https://www.akeebabackup.com/home/news/1561-security-updates-august-2014.html 3.2.0-3.2.7, 3.3.0-3.3.13, 3.4.0-3.4.3, 3.5.x, 3.6.0-3.6.12, 3.7.x, 3.8.0-3.8.2, 3.9.x, 3.10.x, 3.11.0-3.11.3...
Joomla Multicalendar, 5.3.2 and previous versions,
Joomla Multicalendar, 5.3.2 and previous versions, XSS Cross Site Scripting UpdateNoticeURL http://www.joomlacalendars.com/faq/multi-view-calendar-for-joomlaq39...
JChatSocial, 2.2 and lower
JChatSocial, 2.2 and lower, XSS Cross Site Scripting...
Watchful Client (watchful.li extension), 1.9.0 and lower
Extension was not preventing execution of files outside of the framework, and therefore enabling potential unwanted information disclosure and other attacks using weak hash key implementation. Update to version 1.9.1 : https://watchful.li/news/watchful-1-9-1-released.html...
kunena 3.0.5 XSS and SQL Injection
kunena 3.0.5 XSS and SQL Injection Update notice http://www.kunena.org/blog/139-kunena-3-0-6-released...
youtube gallery, 4.1.7,
youtube gallery, 4.1.7, SQL Injection Extension Update Details 4.1.9 UpdateNoticeURL http://www.joomlaboat.com/youtube-gallery...
K2 Content Extension, 2.6.8,
K2 Content Extension, 2.6.8, XSS Cross Site Scripting resolution update to version 2.6.9...
Joomlaworks allvideos
Joomlaworks allvideos plugin version 4.5.0 and previous XSS cross-site scripting Extension Update Details The new 4.6.0 version released replaces the XSS affected JW Player v5 with the newest v6. UpdateNoticeURL http://www.joomlaworks.net/forum/extension-updates/14896-june-3rd,-2014-allvideos-v4-...
JW player, 5.10.22 xss
JW player, 5.10.2295, XSS Cross Site Scripting Update notice url:http://www.joomlaworks.net/forum/extension-updates/14896-june-3rd,-2014-allvideos-v4-6-0...
EasyBlog pre 3.9.15770
EasyBlog Extension Update Details. This fix has been included in EasyBlog 3.9.15770 UpdateNoticeURL http://stackideas.com/blog/easyblog-3-9-15770-released...
plg_highlight_button, 1.5 and previious sqli
plghighlightbutton, 1.5 and previious versions, SQL Injection Update notice: http://www.jonijnm.es/web/descargas/category/9-highlight-code.html...
plg_highlight_content, 1.5 and previous
plghighlightcontent, 1.5 and previious versions, XSS Cross Site Scripting update notice: http://www.jonijnm.es/web/descargas/category/9-highlight-code.html...
Codels codehighlighter 1.4
Codels plgcontentcodehighlighter version 1.4 and previous. XSS Cross Site Scripting...
plg_codehighlight, 1.0.1 , xss
union-d codehighlight, 1.0.1 , XSS Cross Site Scripting...
[20140303] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability...
[20140302] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in comcontact...
ActiveHelper LiveHelp, 3.2.0, sqli
ActiveHelper LiveHelp, 3.2.0, SQL Injection We already updated the LiveHelp Server to the version 3.3.0 that include a security patch that fixes the reported issue. We also include a few improvements on other units. Update Notice URL...
Google Maps plugin for Joomla, pre 3.1 and 2.20,
Google Maps plugin for Joomla, 3.1 and 2.20, XSS Cross Site Scripting joomla-base reumer.net developer statement A SECURITY RELEASE 3.1 of plugin Google Maps by Reumer is released and this must be applied to your Joomla installation...
JJ Shoutbox, 1.2.6,
JJ Shoutbox, 1.2.6, Other Developer statement This security issue was for version 1.2.6 of JJ Shoutbox. We fixed this issue last night and released version 1.3.0 http://joomjunk.co.uk/products/module-home/shoutbox.htmlchangelog...
[20140304] - Core - Unauthorised Logins
Inadequate checking allowed unauthorised logins via GMail authentication...
ODude Dir - DT
ODude DIR - DT-777 developer statement ODude Dir 1.1 updated with fixed securities issues. http://www.odude.com/main/dir/dir-log.html...
ODude Ecard - DT
ODude Ecard - DT - 777 developer statement - ODude Ecard Version 2.1 http://www.odude.com/main/odude-ecard/ecard-log.html...