CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19846
https://notcve.org/view.php?id=CVE-2019-19846
18 Dec 2019 — In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. En Joomla! versiones anteriores a la versión 3.9.14, la falta de comprobación de los parámetros de configuración utilizados en las consultas SQL causó varios vectores de inyección SQL. • https://developer.joomla.org/security-centre/797-20191202-core-various-sql-injections-through-configuration-parameters • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19845
https://notcve.org/view.php?id=CVE-2019-19845
18 Dec 2019 — In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. En Joomla! versiones anteriores a la versión 3.9.14, una falta de comprobación de acceso en los archivos del framework podría conllevar a una divulgación de la ruta. • https://developer.joomla.org/security-centre/796-20191201-core-path-disclosure-in-logger-class • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-18650
https://notcve.org/view.php?id=CVE-2019-18650
06 Nov 2019 — An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. Se descubrió un problema en Joomla! versiones anteriores a la versión 3.9.13. • https://developer.joomla.org/security-centre/794-20191001-core-csrf-in-com-template-overrides-view.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-18674
https://notcve.org/view.php?id=CVE-2019-18674
06 Nov 2019 — An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure. Se descubrió un problema en Joomla! versiones anteriores a 3.9.13. • https://developer.joomla.org/security-centre/795-20191002-core-path-disclosure-in-phpuft8-mapping-files.html • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 4%CPEs: 1EXPL: 0CVE-2019-16725
https://notcve.org/view.php?id=CVE-2019-16725
24 Sep 2019 — In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates. En Joomla! versiones 3.x anteriores a 3.9.12, el escape inadecuado permitió ataques de tipo XSS utilizando el parámetro logo de las plantillas predeterminadas. • https://developer.joomla.org/security-centre/791-20190901-core-xss-in-logo-parameter-of-default-templates.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15028
https://notcve.org/view.php?id=CVE-2019-15028
14 Aug 2019 — In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms. En Joomla! versiones anteriores a 3.9.11, las comprobaciones inadecuadas en la función com_contact podrían permitir el envío de correo en formularios deshabilitados. • https://developer.joomla.org/security-centre/789-20190801-core-hardening-com-contact-contact-form •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12766
https://notcve.org/view.php?id=CVE-2019-12766
11 Jun 2019 — An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors. Un problema fue descubierto en Joomla! • http://www.securityfocus.com/bid/108735 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2019-12765 – Joomla! 3.9.0 < 3.9.7 - CSV Injection
https://notcve.org/view.php?id=CVE-2019-12765
11 Jun 2019 — An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection. Se descubrió un problema en Joomla anterior 3.9.7 la exportación CSV de com_actionslogs es vulnerable a la inyección de CSV. • https://www.exploit-db.com/exploits/48198 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12764
https://notcve.org/view.php?id=CVE-2019-12764
11 Jun 2019 — An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users. Se descubrió un problema en Joomla! Anterior del 3.9.7. • http://www.securityfocus.com/bid/108729 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11809
https://notcve.org/view.php?id=CVE-2019-11809
20 May 2019 — An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector. Un problema fue descubierto en Joomla antes del 3.9.6. Las vistas de depuración de com_users no escapan correctamente a los datos proporcionados por el usuario, lo que conduce a un posible vector de ataque XSS. • https://developer.joomla.org/security-centre/780-20190501-core-xss-in-com-users-acl-debug-view • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •