• Project: Joomla!
  • SubProject: CMS
  • Severity: Low
  • Versions: 3.0.0 through 3.6.4
  • Exploit type: Shell Upload
  • Reported Date: 2016-October-26
  • Fixed Date: 2016-December-06
  • CVE Number: CVE-2016-9836

Description

Inadequate filesystem checks allowed files with alternative PHP file extensions to be uploaded.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.6.4

Solution

Upgrade to version 3.6.5

Contact

The JSST at the Joomla! Security Centre....

Reported By: Xiphos Research Ltd.

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Severity: High
  • Versions: 3.4.4 through 3.6.3
  • Exploit type: Account Modifications
  • Reported Date: 2016-October-26
  • Fixed Date: 2016-October-25
  • CVE Number: CVE-2016-9081

Description

Incorrect use of unfiltered data allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments.

Affected Installs

Joomla! CMS versions 3.4.4 through 3.6.3

Solution

Upgrade to version 3.6.4

Contact

The JSST at the Joomla! Security Centre....

Reported By: Joomla! Security Strike Team

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Severity: Low
  • Versions: 3.2.0 through 3.4.5
  • Exploit type: Directory Traversal
  • Reported Date: 2015-November-26
  • Fixed Date: 2015-December-14
  • CVE Number: requested

Description

Inadequate filtering of request data leads to a Directory Traversal vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.4.5

Solution

Upgrade to version 3.4.6

Contact

The JSST at the Joomla! Security Centre....

Reported By: JSST

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Severity: Low
  • Versions: 3.0.0 through 3.4.6
  • Exploit type: SQL Injection
  • Reported Date: 2015-December-15
  • Fixed Date: 2015-Decemer-21
  • CVE Numbers: requested

Description

Inadequate filtering of request data leads to a SQL Injection vulnerability.

Affected Installs

Joomla! CMS versions 3.0.0 through 3.4.6

Solution

Upgrade to version 3.4.7

Contact

The JSST at the Joomla! Security Centre....

Reported By: Georgios Papadakis

Read more

  • Project: Joomla!
  • SubProject: CMS
  • Severity: High
  • Versions: 3.2.0 through 3.4.4
  • Exploit type: SQL Injection
  • Reported Date: 2015-October-15
  • Fixed Date: 2015-October-22
  • CVE Numbers: CVE-2015-7297, CVE-2015-7857, CVE-2015-7858

Description

Inadequate filtering of request data leads to a SQL Injection vulnerability.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.4.4

Solution

Upgrade to version 3.4.5

Contact

The JSST at the Joomla! Security Centre....

Reported By: Asaf Orpani of Trustwave and Netanel Rubin at PerimeterX

Read more

© 2021 Extly, CB - All rights reserved.