Page 14 of 188 results (0.007 seconds)

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users. Se descubrió un problema en Joomla! versión anterior al 3.9.5. • https://developer.joomla.org/security-centre/778-20190402-core-helpsites-refresh-endpoint-callable-for-unauthenticated-users • CWE-306: Missing Authentication for Critical Function •

CVSS: 9.8EPSS: 52%CPEs: 1EXPL: 3

An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory. Un problema fue descubierto en Joomla! versiones anteriores a 3.9.5. • https://www.exploit-db.com/exploits/46710 https://github.com/dpgg101/CVE-2019-10945 http://packetstormsecurity.com/files/152515/Joomla-3.9.4-Arbitrary-File-Deletion-Directory-Traversal.html https://developer.joomla.org/security-centre/777-20190401-core-directory-traversal-in-com-media • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS. Se ha descubierto un problema en versiones anteriores a la 3.9.4 de Joomla!. El manipulador JSON en com_config carece de una validación de entradas, conduciendo a Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/107374 https://developer.joomla.org/security-centre/772-20190301-core-xss-in-com-config-json-handler • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS. Se ha descubierto un problema en versiones anteriores a la 3.9.4 de Joomla!. El campo "media form" carece de la funcionalidad de escape, conduciendo a Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/107369 https://developer.joomla.org/security-centre/774-20190303-core-xss-in-media-form-field • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS. Se ha descubierto un problema en versiones anteriores a la 3.9.4 de Joomla!. El diseño item_title en edit views carece de la funcionalidad de escape, conduciendo a Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/107371 https://developer.joomla.org/security-centre/773-20190302-core-xss-in-item-title-layout • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •