Ebadfd

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions 4.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 **Description** Improper Access Control List (ACL) checks in custom fields webservice endpoints allow unauthorized users to create fields for components they should not be able to access. **Recommendations** Update Joomla! Core versions 4.0.0 through 5.4.7 to a version newer than 5.4.7. Update Joomla! Core versions 6.0.0 through 6.1.2 to a version newer than 6.1.2.

**Name of the Vulnerable Software and Affected Versions** Elysia versions prior to 1.4.27 **Description** Elysia is a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. A prototype pollution issue exists in Elysia where a cookie can be overridden, specifically using the ` proto ` property. Sending a cookie with the name ` proto ` can override cookie values. This issue is addressed in version 1.4.27. **Recommendations** Versions prior to 1.4.27 should be updated to version 1.4.27 or later. As a workaround, use `t.Cookie` validation to enforce validation of cookie values and/or prevent iteration over cookies if possible.