CVSS: 6.5EPSS: 0%CPEs: 57EXPL: 0CVE-2017-7989
https://notcve.org/view.php?id=CVE-2017-7989
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden. Una inadecuada comprobación de tipos MIME en Joomla! 3.2.0 hasta 3.6.5 permite a usuarios con pocos privilegios cargar archivos swf aunque estén explícitamente prohibidos. • http://www.securityfocus.com/bid/98029 https://developer.joomla.org/security-centre/689-20170407-core-acl-violations • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.3EPSS: 0%CPEs: 46EXPL: 0CVE-2017-8057
https://notcve.org/view.php?id=CVE-2017-8057
In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting. Vulnerabilidad en el componente PeopleSoft Enterprise PeopleTools de Oracle PeopleSoft Products (subcomponente: Fluid Core). Versiones compatibles que son afectadas son 8.54 y 8.55. Vulnerabilidad fácilmente explotable permite a atacante autenticado con acceso a la red a través de HTTP para comprometer PeopleSoft Enterprise PeopleTools. • http://www.securityfocus.com/bid/98028 https://developer.joomla.org/security-centre/690-20170408-core-information-disclosure.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 120EXPL: 0CVE-2017-7988
https://notcve.org/view.php?id=CVE-2017-7988
In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article. El filtrado inadecuado del contenido de los formularios en Joomla! 1.6.0 hasta 3.6.5 permite la sobreescritura del autor de un artículo. El fallo se ha corregido en la versión 3.7.0. • http://www.securityfocus.com/bid/98022 https://developer.joomla.org/security-centre/688-20170406-core-acl-violations •
CVSS: 5.3EPSS: 0%CPEs: 137EXPL: 0CVE-2017-7983
https://notcve.org/view.php?id=CVE-2017-7983
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers. Al enviar un email utilizando JMail API, en Joomla! 1.5.0 hasta 3.6.5, se divulga en la cabecera del email la versión de PHPMailer utilizada. El fallo ha sido corregido en la versión 3.7.0. • http://www.securityfocus.com/bid/98016 https://developer.joomla.org/security-centre/683-20170401-core-information-disclosure • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 137EXPL: 0CVE-2017-7986
https://notcve.org/view.php?id=CVE-2017-7986
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components. Un unadecuado sistema de filtrado de atributos HTML en Joomla! 1.5.0 hasta 3.6.5 permite realizar un ataque de cross-site scripting en varios componentes. • http://www.securityfocus.com/bid/98024 https://developer.joomla.org/security-centre/686-20170404-core-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •