CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-26279 – [20240704] - Core - XSS in Wrapper extensions
https://notcve.org/view.php?id=CVE-2024-26279
The wrapper extensions do not correctly validate inputs, leading to XSS vectors. El filtrado de contenido inadecuado genera vulnerabilidades XSS en varios componentes. • https://developer.joomla.org/security-centre/938-20240704-core-xss-in-wrapper-extensions.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-26278 – [20240705] - Core - XSS in com_fields default field value
https://notcve.org/view.php?id=CVE-2024-26278
The Custom Fields component not correctly filter inputs, leading to a XSS vector. El componente Custom Fields no filtra correctamente las entradas, lo que genera un vector XSS. • https://developer.joomla.org/security-centre/939-20240705-core-xss-in-com-fields-default-field-value.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-40626 – [20231101] - Core - Exposure of environment variables
https://notcve.org/view.php?id=CVE-2023-40626
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information. El proceso de análisis de archivos de idioma podría manipularse para exponer variables de entorno. Las variables de entorno pueden contener información sensible. • https://developer.joomla.org/security-centre/919-20231101-core-exposure-of-environment-variables.html •
CVSS: 5.3EPSS: 94%CPEs: 1EXPL: 45CVE-2023-23752 – Joomla! Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2023-23752
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. Joomla! versions prior to 4.2.8 suffer from an unauthenticated information disclosure vulnerability. • https://www.exploit-db.com/exploits/51334 https://github.com/Acceis/exploit-CVE-2023-23752 https://github.com/ThatNotEasy/CVE-2023-23752 https://github.com/gibran-abdillah/CVE-2023-23752 https://github.com/K3ysTr0K3R/CVE-2023-23752-EXPLOIT https://github.com/Fernando-olv/Joomla-CVE-2023-23752 https://github.com/Ly0kha/Joomla-CVE-2023-23752-Exploit-Script https://github.com/Rival420/CVE-2023-23752 https://github.com/shellvik/CVE-2023-23752 https://github.com/AlissonFaoli/CVE&# • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23751 – [20230102] - Core - Missing ACL checks for com_actionlogs
https://notcve.org/view.php?id=CVE-2023-23751
An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs. • https://developer.joomla.org/security-centre/891-20230102-core-missing-acl-checks-for-com-actionlogs.html • CWE-863: Incorrect Authorization •