- Details
- Category: Security Announcements
- Project: Joomla!
- SubProject: CMS
- Severity: Low
- Versions: 3.2.0 through 3.4.5
- Exploit type: Directory Traversal
- Reported Date: 2015-November-26
- Fixed Date: 2015-December-14
- CVE Number: requested
Description
Inadequate filtering of request data leads to a Directory Traversal vulnerability.
Affected Installs
Joomla! CMS versions 3.2.0 through 3.4.5
Solution
Upgrade to version 3.4.6
Contact
The JSST at the Joomla! Security Centre....
- Details
- Category: Security Announcements
- Project: Joomla!
- SubProject: CMS
- Severity: High
- Versions: 3.2.0 through 3.4.4
- Exploit type: SQL Injection
- Reported Date: 2015-October-15
- Fixed Date: 2015-October-22
- CVE Numbers: CVE-2015-7297, CVE-2015-7857, CVE-2015-7858
Description
Inadequate filtering of request data leads to a SQL Injection vulnerability.
Affected Installs
Joomla! CMS versions 3.2.0 through 3.4.4
Solution
Upgrade to version 3.4.5
Contact
The JSST at the Joomla! Security Centre....
- Details
- Category: Security Announcements
- Project: Joomla!
- SubProject: CMS
- Severity: Moderate
- Versions: 2.5.24 and earlier 2.5.x versions, 3.2.4 and earlier 3.x versions, 3.3.0 through 3.3.3
- Exploit type: Unauthorised Logins
- Reported Date: 2014-September-09
- Fixed Date: 2014-September-23
- CVE Number: CVE-2014-6632
Description
Inadequate checking allowed unauthorised logins via LDAP authentication.
Affected Installs
Joomla! CMS versions 2.5.24 and earlier 2.5.x versions, 3.2.4 and earlier 3.x versions, 3.3.0 through 3.3.3
Solution
Upgrade to version 2.5.25, 3.2.5, or 3.3.4
Contact
The JSST at the Joomla! Security Center....
- Details
- Category: Security Announcements
- Project: Joomla!
- SubProject: CMS
- Severity: Low
- Versions: 3.2.0 through 3.4.1
- Exploit type: CSRF Protection
- Reported Date: 2015-April-06
- Fixed Date: 2015-June-30
- CVE Number: tbd
Description
Lack of CSRF checks potentially enabled uploading malicious code.
Affected Installs
Joomla! CMS versions 3.2.0 through 3.4.1
Solution
Upgrade to version 3.4.2
Contact
The JSST at the Joomla! Security Center....
- Details
- Category: Security Announcements
- Project: Joomla!
- SubProject: CMS
- Severity: Moderate
- Versions: 3.1.2 through 3.2.2
- Exploit type: XSS Vulnerability
- Reported Date: 2014-March-04
- Fixed Date: 2014-March-06
- CVE Number: Pending
Description
Inadequate escaping leads to XSS vulnerability in com_contact.
Affected Installs
Joomla! CMS versions 3.1.2 through 3.2.2
Solution
Upgrade to version 3.2.3
Contact
The JSST at the Joomla! Security Center....
