Page 21 of 197 results (0.015 seconds)

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state. En Joomla! en versiones anteriores a la 3.8.0, un error de lógica en una consulta SQL puede llevar a la divulgación de textos de introducción de artículos cuando estos artículos se encuentran archivados. • http://www.securityfocus.com/bid/100900 http://www.securitytracker.com/id/1039407 https://developer.joomla.org/security-centre/710-20170901-core-information-disclosure •

CVSS: 8.8EPSS: 0%CPEs: 180EXPL: 0

The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs. El instalador CMS en versiones anteriores a la 3.7.4 de Joomla! no verifica la propiedad de un usuario en un espacio web, lo que permite que usuarios remotos autenticados consigan control sobre la aplicación objetivo, haciendo uso de los logs del estándar Certificate Transparency. • http://www.securitytracker.com/id/1039015 https://developer.joomla.org/security-centre/700-20170704-core-installer-lack-of-ownership-verification.html https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Hanno-Boeck-Abusing-Certificate-Transparency-Logs.pdf https://twitter.com/hanno/status/890281330906247168 • CWE-295: Improper Certificate Validation •

CVSS: 6.1EPSS: 0%CPEs: 160EXPL: 0

In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components. En Joomla! en versiones anteriores a la 3.7.4, el filtrado inadecuado de etiquetas HTML potencialmente maliciosas conduce a vulnerabilidades XSS en varios componentes. • http://www.securitytracker.com/id/1039014 https://developer.joomla.org/security-centre/701-20170605-core-xss-vulnerability.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 103EXPL: 1

Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability. Perdidos tokens CSRF verificados y validación inapropiada de la entrada en Joomla! CMS 1.7.3 hasta la 3.7.2 que lleva a una vulnerabilidad XSS. • https://github.com/xyringe/CVE-2017-9934 http://www.securityfocus.com/bid/99451 http://www.securitytracker.com/id/1038817 https://developer.joomla.org/security-centre/697-20170602-core-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 114EXPL: 0

Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents. Invalidación del cache inapropiada en Joomla! CMS 1.7.3 hasta la 3.7.2 que lleva a una revelación de los contenidos • http://www.securityfocus.com/bid/99450 http://www.securitytracker.com/id/1038817 https://developer.joomla.org/security-centre/696-20170601-core-information-disclosure • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •