CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-40626 – [20231101] - Core - Exposure of environment variables
https://notcve.org/view.php?id=CVE-2023-40626
29 Nov 2023 — The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information. El proceso de análisis de archivos de idioma podría manipularse para exponer variables de entorno. Las variables de entorno pueden contener información sensible. • https://github.com/TLWebdesign/Joomla-3.10.12-languagehelper-hotfix •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-1435
https://notcve.org/view.php?id=CVE-2010-1435
21 Jun 2021 — Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. • https://developer.joomla.org/security-centre/308-20100423-core-password-reset-tokens.html • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2010-1434
https://notcve.org/view.php?id=CVE-2010-1434
21 Jun 2021 — Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. • https://developer.joomla.org/security-centre/309-20100423-core-sessation-fixation.html • CWE-384: Session Fixation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-1433
https://notcve.org/view.php?id=CVE-2010-1433
21 Jun 2021 — Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. Joomla! • https://developer.joomla.org/security-centre/310-20100423-core-installer-migration-script.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2010-1432
https://notcve.org/view.php?id=CVE-2010-1432
21 Jun 2021 — Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. • https://developer.joomla.org/security-centre/311-20100423-core-negative-values-for-limit-and-offset.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26029 – [20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field
https://notcve.org/view.php?id=CVE-2021-26029
04 Mar 2021 — An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field. Se detectó un problema en Joomla! versiones 1.6.0 hasta 3.9.24. • https://developer.joomla.org/security-centre/849-20210309-core-inadequate-filtering-of-form-contents-could-allow-to-overwrite-the-author-field.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35616 – [20201107] - Core - Write ACL violation in multiple core views
https://notcve.org/view.php?id=CVE-2020-35616
28 Dec 2020 — An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations. Se detectó un problema en Joomla! versiones 1.7.0 hasta 3.9.22. • https://developer.joomla.org/security-centre/834-20201107-core-write-acl-violation-in-multiple-core-views.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10243
https://notcve.org/view.php?id=CVE-2020-10243
16 Mar 2020 — An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype. Se detectó un problema en Joomla! versiones anteriores a 3.9.16. • https://developer.joomla.org/security-centre/807-20200306-core-sql-injection-in-featured-articles-menu-parameters • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2011-1151
https://notcve.org/view.php?id=CVE-2011-1151
05 Feb 2020 — Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters. Joomla! versión 1.6.0, es vulnerable a una inyección SQL por medio de los parámetros filter_order y filer_order_Dir. • https://packetstormsecurity.com/files/101835/Joomla-1.6.0-SQL-Injection.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4912
https://notcve.org/view.php?id=CVE-2011-4912
04 Feb 2020 — Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass. En com_mailto de Joomla! versiones 1.5.x hasta 1.5.13, presenta una omisión de tiempo de espera de correo automatizada. • https://developer.joomla.org/security/news/303-20090723-core-com-mailto-timeout-issue.html • CWE-732: Incorrect Permission Assignment for Critical Resource •