Bitnami package
joomla
pkg:bitnami/joomla
Vulnerabilities (134)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-13761 | Med | 6.1 | >= 3.0.0, < 3.9.19 | 3.9.19 | Jun 2, 2020 | In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS. | |
| CVE-2020-13760 | Hig | 8.8 | >= 3.7.0, < 3.9.19 | 3.9.19 | Jun 2, 2020 | In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF. | |
| CVE-2020-11891 | Med | 5.3 | >= 3.8.8, < 3.9.17 | 3.9.17 | Apr 21, 2020 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups. | |
| CVE-2020-11890 | Med | 5.3 | >= 2.5.0, < 3.9.17 | 3.9.17 | Apr 21, 2020 | An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration. | |
| CVE-2020-11889 | Med | 5.3 | >= 2.5.0, < 3.9.17 | 3.9.17 | Apr 21, 2020 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups. | |
| CVE-2020-10243 | Cri | 9.8 | >= 1.7.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype. | |
| CVE-2020-10242 | Med | 6.1 | >= 3.0.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks. | |
| CVE-2020-10241 | Hig | 8.8 | >= 3.2.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF. | |
| CVE-2020-10240 | Med | 5.3 | >= 3.0.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses. | |
| CVE-2020-10239 | Hig | 8.8 | >= 3.7.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. | |
| CVE-2020-10238 | Hig | 7.5 | >= 2.5.0, < 3.9.16 | 3.9.16 | Mar 16, 2020 | An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors. | |
| CVE-2020-8421 | Med | 6.1 | >= 3.9.0, < 3.9.14 | 3.9.14 | Jan 28, 2020 | An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs. | |
| CVE-2020-8420 | Hig | 8.8 | >= 3.0.0, < 3.9.15 | 3.9.15 | Jan 28, 2020 | An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability. | |
| CVE-2020-8419 | Hig | 8.8 | >= 3.0.0, < 3.9.15 | 3.9.15 | Jan 28, 2020 | An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities. |
- affected >= 3.0.0, < 3.9.19fixed 3.9.19
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.
- affected >= 3.7.0, < 3.9.19fixed 3.9.19
In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
- affected >= 3.8.8, < 3.9.17fixed 3.9.17
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.
- affected >= 2.5.0, < 3.9.17fixed 3.9.17
An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.
- affected >= 2.5.0, < 3.9.17fixed 3.9.17
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.
- affected >= 1.7.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.
- affected >= 3.0.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.
- affected >= 3.2.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.
- affected >= 3.0.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.
- affected >= 3.7.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.
- affected >= 2.5.0, < 3.9.16fixed 3.9.16
An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.
- affected >= 3.9.0, < 3.9.14fixed 3.9.14
An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
- affected >= 3.0.0, < 3.9.15fixed 3.9.15
An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.
- affected >= 3.0.0, < 3.9.15fixed 3.9.15
An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.
Page 7 of 7