CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23794 – [20220302] - Core - Path Disclosure within filesystem error messages
https://notcve.org/view.php?id=CVE-2022-23794
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application. Se ha detectado un problema en Joomla! • https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2022-23793 – [20220301] - Core - Zip Slip within the Tar extractor
https://notcve.org/view.php?id=CVE-2022-23793
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path. Se ha detectado un problema en Joomla! versiones 3.0.0 hasta 3.10.6 y 4.0.0 hasta 4.1.0. • http://packetstormsecurity.com/files/166546/Joomla-4.1.0-Zip-Slip-File-Overwrite-Path-Traversal.html https://developer.joomla.org/security-centre/870-20220301-core-zip-slip-within-the-tar-extractor.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26039 – [20210705] - Core - XSS in com_media imagelist
https://notcve.org/view.php?id=CVE-2021-26039
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability. Se ha detectado un problema en Joomla! Versiones 3.0.0 hasta 3.9.27. • https://developer.joomla.org/security-centre/860-20210705-core-xss-in-com-media-imagelist.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26038 – [20210704] - Core - Privilege escalation through com_installer
https://notcve.org/view.php?id=CVE-2021-26038
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for com_installer is limited to super users already. Se ha detectado un problema en Joomla! • https://developer.joomla.org/security-centre/859-20210704-core-privilege-escalation-through-com-installer.html • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26037 – [20210703] - Core - Lack of enforced session termination
https://notcve.org/view.php?id=CVE-2021-26037
An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked. Se ha detectado un problema en Joomla! versiones 2.5.0 hasta 3.9.27. • https://developer.joomla.org/security-centre/858-20210703-core-lack-of-enforced-session-termination.html • CWE-613: Insufficient Session Expiration •