Search
Total
40 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-40626 | 1 Joomla | 1 Joomla\! | 2023-12-05 | N/A | 7.5 HIGH |
| The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information. | |||||
| CVE-2020-10239 | 1 Joomla | 1 Joomla\! | 2021-07-21 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. | |||||
| CVE-2021-26036 | 1 Joomla | 1 Joomla\! | 2021-07-09 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table. | |||||
| CVE-2021-26038 | 1 Joomla | 1 Joomla\! | 2021-07-09 | 4.3 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for com_installer is limited to super users already. | |||||
| CVE-2010-1432 | 1 Joomla | 1 Joomla\! | 2021-06-25 | 5.0 MEDIUM | 7.5 HIGH |
| Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. | |||||
| CVE-2010-1434 | 1 Joomla | 1 Joomla\! | 2021-06-25 | 5.0 MEDIUM | 7.5 HIGH |
| Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. | |||||
| CVE-2021-23131 | 1 Joomla | 1 Joomla\! | 2021-03-05 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager. | |||||
| CVE-2021-23132 | 1 Joomla | 1 Joomla\! | 2021-03-05 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads | |||||
| CVE-2020-35610 | 1 Joomla | 1 Joomla\! | 2020-12-30 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms. | |||||
| CVE-2020-35611 | 1 Joomla | 1 Joomla\! | 2020-12-30 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values. | |||||
| CVE-2020-35612 | 1 Joomla | 1 Joomla\! | 2020-12-30 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerability. | |||||
| CVE-2020-35616 | 1 Joomla | 1 Joomla\! | 2020-12-30 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations. | |||||
| CVE-2020-13763 | 1 Joomla | 1 Joomla\! | 2020-10-19 | 5.0 MEDIUM | 7.5 HIGH |
| In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users. | |||||
| CVE-2020-13760 | 1 Joomla | 1 Joomla\! | 2020-10-19 | 6.8 MEDIUM | 8.8 HIGH |
| In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF. | |||||
| CVE-2018-17855 | 1 Joomla | 1 Joomla\! | 2020-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself. | |||||
| CVE-2018-17856 | 1 Joomla | 1 Joomla\! | 2020-08-24 | 6.5 MEDIUM | 7.2 HIGH |
| An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution. | |||||
| CVE-2019-10946 | 1 Joomla | 1 Joomla\! | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users. | |||||
| CVE-2019-14654 | 1 Joomla | 1 Joomla\! | 2020-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9. | |||||
| CVE-2019-9713 | 1 Joomla | 1 Joomla\! | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access. | |||||
| CVE-2020-10238 | 1 Joomla | 1 Joomla\! | 2020-03-19 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors. | |||||
| CVE-2020-10241 | 1 Joomla | 1 Joomla\! | 2020-03-18 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF. | |||||
| CVE-2020-8420 | 1 Joomla | 1 Joomla\! | 2020-02-07 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability. | |||||
| CVE-2020-8419 | 1 Joomla | 1 Joomla\! | 2020-02-06 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities. | |||||
| CVE-2011-4937 | 1 Joomla | 1 Joomla\! | 2020-02-05 | 5.0 MEDIUM | 7.5 HIGH |
| Joomla! 1.7.1 has core information disclosure due to inadequate error checking. | |||||
| CVE-2011-3629 | 1 Joomla | 1 Joomla\! | 2020-02-05 | 5.0 MEDIUM | 7.5 HIGH |
| Joomla! core 1.7.1 allows information disclosure due to weak encryption | |||||
| CVE-2012-1563 | 1 Joomla | 1 Joomla\! | 2020-01-22 | 5.0 MEDIUM | 7.5 HIGH |
| Joomla! before 2.5.3 allows Admin Account Creation. | |||||
| CVE-2012-1562 | 1 Joomla | 1 Joomla\! | 2020-01-22 | 5.0 MEDIUM | 7.5 HIGH |
| Joomla! core before 2.5.3 allows unauthorized password change. | |||||
| CVE-2019-18650 | 1 Joomla | 1 Joomla\! | 2019-11-06 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. | |||||
| CVE-2018-11323 | 1 Joomla | 1 Joomla\! | 2019-10-03 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions. | |||||
| CVE-2018-15881 | 1 Joomla | 1 Joomla\! | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation. | |||||
| CVE-2018-17858 | 1 Joomla | 1 Joomla\! | 2018-11-26 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend. | |||||
| CVE-2018-12712 | 1 Joomla | 1 Joomla\! | 2018-08-20 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion. | |||||
| CVE-2018-11322 | 1 Joomla | 1 Joomla\! | 2018-06-22 | 6.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver. | |||||
| CVE-2018-8045 | 1 Joomla | 1 Joomla\! | 2018-04-09 | 6.5 MEDIUM | 8.8 HIGH |
| In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view. | |||||
| CVE-2016-9838 | 1 Joomla | 1 Joomla\! | 2017-09-02 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and password, as demonstrated by submitting a form that targets the `registration.register` task. | |||||
| CVE-2017-11364 | 1 Joomla | 1 Joomla\! | 2017-08-04 | 6.5 MEDIUM | 8.8 HIGH |
| The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs. | |||||
| CVE-2016-8870 | 1 Joomla | 1 Joomla\! | 2017-07-29 | 6.8 MEDIUM | 8.1 HIGH |
| The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting. | |||||
| CVE-2017-9933 | 1 Joomla | 1 Joomla\! | 2017-07-20 | 5.0 MEDIUM | 7.5 HIGH |
| Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents. | |||||
| CVE-2016-9837 | 1 Joomla | 1 Joomla\! | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in templates/beez3/html/com_content/article/default.php in Joomla! before 3.6.5. Inadequate permissions checks in the Beez3 layout override of the com_content article view allow users to view articles that should not be publicly accessible, as demonstrated by an index.php?option=com_content&view=article&id=1&template=beez3 request. | |||||
| CVE-2015-8769 | 1 Joomla | 1 Joomla\! | 2016-12-07 | 7.5 HIGH | 7.3 HIGH |
| SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors. | |||||