Joomla: Security Vulnerabilities
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.
CVSS Score
9.8
EPSS Score
0.001
Published
2017-11-10
Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
CVSS Score
6.1
EPSS Score
0.001
Published
2017-09-20
In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.
CVSS Score
3.7
EPSS Score
0.001
Published
2017-09-20
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
CVSS Score
9.8
EPSS Score
0.04
Published
2017-09-20
The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.
CVSS Score
8.8
EPSS Score
0.001
Published
2017-08-02
In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.
CVSS Score
6.1
EPSS Score
0.002
Published
2017-07-26
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents.
CVSS Score
7.5
EPSS Score
0.0
Published
2017-07-17
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
CVSS Score
6.1
EPSS Score
0.004
Published
2017-07-17
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score
9.8
EPSS Score
0.943
Published
2017-05-17
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers.
CVSS Score
5.3
EPSS Score
0.0
Published
2017-04-25