Vulnerabilities (CVE)

Filtered by vendor Joomla Subscribe
Filtered by product Joomla\!
Total 588 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-10946 1 Joomla 1 Joomla\! 2024-02-28 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.
CVE-2019-9712 1 Joomla 1 Joomla\! 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS.
CVE-2019-9711 1 Joomla 1 Joomla\! 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS.
CVE-2019-14654 1 Joomla 1 Joomla\! 2024-02-28 6.5 MEDIUM 8.8 HIGH
In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
CVE-2019-12764 1 Joomla 1 Joomla\! 2024-02-28 4.0 MEDIUM 6.5 MEDIUM
An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.
CVE-2019-11809 1 Joomla 1 Joomla\! 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.
CVE-2019-10945 1 Joomla 1 Joomla\! 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.
CVE-2019-11831 5 Debian, Drupal, Fedoraproject and 2 more 5 Debian Linux, Drupal, Fedora and 2 more 2024-02-28 7.5 HIGH 9.8 CRITICAL
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
CVE-2019-12765 1 Joomla 1 Joomla\! 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
CVE-2019-9714 1 Joomla 1 Joomla\! 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS.
CVE-2018-17859 1 Joomla 1 Joomla\! 2024-02-28 4.0 MEDIUM 4.3 MEDIUM
An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabled forms.
CVE-2018-15882 1 Joomla 1 Joomla\! 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter.
CVE-2019-7742 1 Joomla 1 Joomla\! 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector.
CVE-2018-17858 1 Joomla 1 Joomla\! 2024-02-28 6.8 MEDIUM 8.8 HIGH
An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend.
CVE-2019-7740 1 Joomla 1 Joomla\! 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector.
CVE-2018-17856 1 Joomla 1 Joomla\! 2024-02-28 6.5 MEDIUM 7.2 HIGH
An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.
CVE-2018-17857 1 Joomla 1 Joomla\! 2024-02-28 4.0 MEDIUM 4.3 MEDIUM
An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation.
CVE-2018-17855 1 Joomla 1 Joomla\! 2024-02-28 6.5 MEDIUM 8.8 HIGH
An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.
CVE-2019-7743 1 Joomla 1 Joomla\! 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
CVE-2019-7744 1 Joomla 1 Joomla\! 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.