CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10242
https://notcve.org/view.php?id=CVE-2020-10242
16 Mar 2020 — An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks. Se detectó un problema en Joomla! versiones anteriores a 3.9.16. • https://developer.joomla.org/security-centre/803-20200302-core-xss-in-protostar-and-beez3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10241
https://notcve.org/view.php?id=CVE-2020-10241
16 Mar 2020 — An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF. Se detectó un problema en Joomla! versiones anteriores a 3.9.16. • https://developer.joomla.org/security-centre/802-20200301-core-csrf-in-com-templates-image-actions • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10240
https://notcve.org/view.php?id=CVE-2020-10240
16 Mar 2020 — An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses. Se detectó un problema en Joomla! versiones anteriores a 3.9.16. • https://developer.joomla.org/security-centre/805-20200304-core-identifier-collisions-in-com-users • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2020-10239
https://notcve.org/view.php?id=CVE-2020-10239
16 Mar 2020 — An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. Se detectó un problema en Joomla! versiones anteriores a 3.9.16. • https://github.com/HoangKien1020/CVE-2020-10239 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2020-10238
https://notcve.org/view.php?id=CVE-2020-10238
16 Mar 2020 — An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors. Se detectó un problema en Joomla! versiones anteriores a 3.9.16. • https://github.com/HoangKien1020/CVE-2020-10238 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8419
https://notcve.org/view.php?id=CVE-2020-8419
28 Jan 2020 — An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities. Se detectó un problema en Joomla! versiones anteriores a 3.9.15. • https://developer.joomla.org/security-centre/798-20200101-core-csrf-in-batch-actions • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8420
https://notcve.org/view.php?id=CVE-2020-8420
28 Jan 2020 — An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability. Se detectó un problema en Joomla! versiones anteriores a 3.9.15. • https://developer.joomla.org/security-centre/799-20200102-core-csrf-com-templates-less-compiler • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19846
https://notcve.org/view.php?id=CVE-2019-19846
18 Dec 2019 — In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. En Joomla! versiones anteriores a la versión 3.9.14, la falta de comprobación de los parámetros de configuración utilizados en las consultas SQL causó varios vectores de inyección SQL. • https://developer.joomla.org/security-centre/797-20191202-core-various-sql-injections-through-configuration-parameters • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19845
https://notcve.org/view.php?id=CVE-2019-19845
18 Dec 2019 — In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. En Joomla! versiones anteriores a la versión 3.9.14, una falta de comprobación de acceso en los archivos del framework podría conllevar a una divulgación de la ruta. • https://developer.joomla.org/security-centre/796-20191201-core-path-disclosure-in-logger-class • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-18650
https://notcve.org/view.php?id=CVE-2019-18650
06 Nov 2019 — An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. Se descubrió un problema en Joomla! versiones anteriores a la versión 3.9.13. • https://developer.joomla.org/security-centre/794-20191001-core-csrf-in-com-template-overrides-view.html • CWE-352: Cross-Site Request Forgery (CSRF) •