761 matches found
[20130201] - Core - Information Disclosure
Method of encoding search terms led to possible information disclosure...
[20121102] - Core - Clickjacking
Inadequate protection leads to clickjacking vulnerability...
[20121101] - Core - Clickjacking
Inadequate protection leads to clickjacking vulnerability...
[20121001] - Core - XSS Vulnerability
Typographical error leads to XSS vulnerability in language search component...
[20120902] - Core - XSS Vulnerability
Inadequate escaping of output leads to XSS vulnerability in language switcher module...
[20120602] - Core - Information Disclosure
Inadequate filtering leads SQL error and information disclosure...
[20120901] - Core - XSS Vulnerability
Inadequate escaping of output leads to XSS vulnerability...
[20120601] - Core - Privilege Escalation
Inadequate checking leads to possible user privilege escalation...
[20120303] - Core - Privilege Escalation
Programming error allows privilege escalation in some cases...
[20120305] - Core - Password Change
Insufficient randomness leads to password reset vulnerability...
[20120304] - Core - Password Change
Insufficient randomness leads to password reset vulnerability...
[20120302] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability...
[20120301] - Core - SQL Injection
Inadequate escaping leads to SQL injection vulnerability...
[20120308] - Core - XSS Vulnerability
Inadequate filtering in update manager leads to XSS vulnerability...
[20120201] - Core - Information Disclosure
Inadequate validation leads to information disclosure in administrator...
[20120203] - Core - Information Disclosure
Inadequate validation leads to path disclosure in administrator...
[20120104] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability...
[20120101] - Core - Information Disclosure
Inadequate filtering leads to information disclosure...
[20120306] - Core - Information Disclosure
Inadequate permission checking allows unauthorised viewing of administrative back end information...
[20120307] - Core - Information Disclosure
Inadequate permission checking allows unauthorised viewing of some administrative back end information...
[20120202] - Core - Information Disclosure
On some servers the error log could be read by unauthorised users...
[20120103] - Core - Information Disclosure
Inadequate filtering leads to information disclosure...
[20120102] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability...
[20111103] - Core - Password Change
Weak random number generation during password reset leads to possibility of changing a user's password...
[20111102] - Core - Password Change
Weak random number generation during password reset leads to possibility of changing a user's password...
[20111101] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in back end...
[20110903] - Core - Information Disclosure
Inadequate error checking causes information disclosure...
[20111003] - Core - Information Disclosure
Weak encryption causes potential information disclosure...
[20111001] - Core - Information Disclosure
Weak encryption causes potential information disclosure...
[20111002] - Core - Information Disclosure
Inadequate error checking causes potential information disclosure...
[20110902] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in back end...
[20110901] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in comsearch...
[20110701] - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability...
[20110604] - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability...
[20110602] - Information Disclosure
Inadequate filtering causes possible information disclosure...
[20100423] - Core - Sessation Fixation
Session id doesn't get modified when user logs in. A remote site may be able to forward a visitor to the Joomla! site and set a specific cookie. If the user then logs in, the remote site can use that cookie to authenticate as that user...
[20100423] - Core - Negative Values for Limit and Offset
If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system...
[20100423] - Core - Password Reset Tokens
When a user requests a password reset, the reset tokens were stored in plain text in the database. While this is not a vulnerability in itself, it allows user accounts to be compromised if there is an extension on the site with an SQL injection vulnerability...
[20100423] - Core - Installer Migration Script
The migration script in the Joomla! installer does not check the file type being uploaded. If the installation application is present, an attacker could use it to upload malicious files to a server...
[20091103] - Core - XML File Read Issue
It is possible to read the contents of an extension's XML file and find the version number of the installed extension. This could allow people to exploit a known security flaws for a specific version of an extension...
[20091103] - Core - Front-End Editor Issue
When logged into the front end with Author access, it was possible to replace an article written by another user...
[20090723] - Core - com_mailto Timeout Issue
In commailto, it was possible to bypass timeout protection against sending automated emails...
[20090722] - Core - File Upload
Tiny browser included with TinyMCE 3.0 editor allowed files to be uploaded and removed without logging in...
[20090722] - Core - Missing JEXEC Check
Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host...
[20090604] - Core - Frontend XSS - HTTP_REFERER not properly filtered
An attacker can inject JavaScript or DHTML code that will be executed in the context of targeted user browser, allowing the attacker to steal cookies. HTTPREFERER variable is not properly parsed...
[20090606] - Core - Missing JEXEC Check
Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host...
[20090605] - Core - Frontend XSS - PHP_SELF not properly filtered
An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser...
[20090603] - Core - Frontend XSS
Some values were output from the database without being properly escaped. Most strings in question were sourced from the administrator panel...