Bitnami package
joomla
pkg:bitnami/joomla
Vulnerabilities (144)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-24599 | Med | 6.1 | >= 3.9.0, < 3.9.21 | 3.9.21 | Aug 26, 2020 | An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks. | |
| CVE-2020-24598 | Med | 6.1 | >= 3.0.0, < 3.9.21 | 3.9.21 | Aug 26, 2020 | An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect. | |
| CVE-2020-15700 | Med | 6.3 | >= 3.7.0, <= 3.9.19 | — | Jul 15, 2020 | An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability. | |
| CVE-2020-15699 | Med | 5.3 | >= 2.5.0, <= 3.9.19 | — | Jul 15, 2020 | An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration. | |
| CVE-2020-15698 | Med | 5.3 | >= 3.0.0, <= 3.9.19 | — | Jul 15, 2020 | An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials | |
| CVE-2020-15697 | Med | 4.3 | >= 3.0.0, <= 3.9.19 | — | Jul 15, 2020 | An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users. | |
| CVE-2020-15696 | Med | 6.1 | >= 3.0.0, <= 3.9.19 | — | Jul 15, 2020 | An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image. | |
| CVE-2020-15695 | Med | 6.3 | >= 3.9.0, <= 3.9.19 | — | Jul 15, 2020 | An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability. | |
| CVE-2020-13763 | Hig | 7.5 | >= 2.5.0, < 3.9.19 | 3.9.19 | Jun 2, 2020 | In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users. | |
| CVE-2020-13762 | Med | 6.1 | >= 3.9.0, < 3.9.19 | 3.9.19 | Jun 2, 2020 | In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS. | |
| CVE-2020-13761 | Med | 6.1 | >= 3.0.0, < 3.9.19 | 3.9.19 | Jun 2, 2020 | In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS. | |
| CVE-2020-13760 | Hig | 8.8 | >= 3.7.0, < 3.9.19 | 3.9.19 | Jun 2, 2020 | In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF. | |
| CVE-2020-11891 | Med | 5.3 | >= 3.8.8, < 3.9.17 | 3.9.17 | Apr 21, 2020 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups. | |
| CVE-2020-11890 | Med | 5.3 | >= 2.5.0, < 3.9.17 | 3.9.17 | Apr 21, 2020 | An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration. | |
| CVE-2020-11889 | Med | 5.3 | >= 2.5.0, < 3.9.17 | 3.9.17 | Apr 21, 2020 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups. | |
| CVE-2020-10243 | Cri | 9.8 | >= 1.7.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype. | |
| CVE-2020-10242 | Med | 6.1 | >= 3.0.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks. | |
| CVE-2020-10241 | Hig | 8.8 | >= 3.2.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF. | |
| CVE-2020-10240 | Med | 5.3 | >= 3.0.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses. | |
| CVE-2020-10239 | Hig | 8.8 | >= 3.7.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. |
- affected >= 3.9.0, < 3.9.21fixed 3.9.21
An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.
- affected >= 3.0.0, < 3.9.21fixed 3.9.21
An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.
- affected >= 3.7.0, <= 3.9.19
An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability.
- affected >= 2.5.0, <= 3.9.19
An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration.
- affected >= 3.0.0, <= 3.9.19
An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials
- affected >= 3.0.0, <= 3.9.19
An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.
- affected >= 3.0.0, <= 3.9.19
An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.
- affected >= 3.9.0, <= 3.9.19
An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.
- affected >= 2.5.0, < 3.9.19fixed 3.9.19
In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
- affected >= 3.9.0, < 3.9.19fixed 3.9.19
In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.
- affected >= 3.0.0, < 3.9.19fixed 3.9.19
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.
- affected >= 3.7.0, < 3.9.19fixed 3.9.19
In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
- affected >= 3.8.8, < 3.9.17fixed 3.9.17
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.
- affected >= 2.5.0, < 3.9.17fixed 3.9.17
An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.
- affected >= 2.5.0, < 3.9.17fixed 3.9.17
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.
- affected >= 1.7.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.
- affected >= 3.0.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.
- affected >= 3.2.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.
- affected >= 3.0.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.
- affected >= 3.7.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.
Page 7 of 8