David Jardin

Um controle de acesso inadequado na extensão do editor JCE para Joomla permite que usuários não autenticados criem novos perfis de editor. Essa falha possibilita o upload e a execução de código PHP arbitrário no servidor afetado, o que pode ser utilizado para instalar web shells e estabelecer backdoors persistentes para o comprometimento total do site.

The issue allows unauthorized actors to obtain the number of subscribers in a specific list, exposing sensitive information.

The issue is related to an Improper Access Control vulnerability in the AcyMailing Enterprise component for Joomla. It allows unauthorized removal of attachments from campaigns.

The issue is related to an Improper Access Control vulnerability in the AcyMailing Enterprise component for Joomla. This vulnerability allows unauthorized users to create new mailing lists.

The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). This enables potential attackers to inject malicious scripts into web pages.

Foi descoberta uma falha em que verificações incorretas de ACL poderiam permitir a alteração não autorizada da categoria de um artigo.

An issue was discovered where the phar:// stream wrapper can be used for object injection attacks due to the lack of a protection mechanism. This allows the phar:// handler to be used for non .phar-files, potentially leading to exploitation.

An issue in com contact allows mail submission in disabled forms due to inadequate checks.

The issue is related to inadequate filtering of file and folder names, which leads to various XSS attack vectors in the media manager.

A lack of escaping the user-info component of the URI could result in an XSS issue under specific circumstances, such as when a redirect is issued with a URI containing a username and password, and the Location: header cannot be used.

A race condition issue was discovered, related to long-running background processes such as remote checks for core or extension updates. This could lead to the recreation of a session that was expected to be destroyed.

The issue is related to a lack of escaping in the module chromes, which leads to XSS vulnerabilities in the module system.

The issue is related to inadequate escaping of file and folder names, which leads to XSS vulnerabilities in the template manager component.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.