Joomla! vulnerabilities

The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.

SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.

A directory traversal vulnerability in Joomla! versions 3.2.0 through 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.

Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.

Joomla! versions 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header.

Joomla! versions 3.2 before 3.4.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Joomla! versions 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allow remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.

Improper access checks in the Easy Store extension (versions 1.0.0-2.0.1) for Joomla allow logged-in users to retrieve order and customer information of any order in the system.

Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.

An improper access check allows privilege escalation through the com_users batch task.

An improper access check in the com_users batch task allows privilege escalation.

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

In Joomla! before version 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

Joomla! versions 3.4.4 through 3.6.3 allow attackers to reset username, password, and user group assignments, and possibly perform other user account modifications via unspecified vectors.

The register method in the UsersModelRegistration class in Joomla! before version 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.

Joomla! Core has an improper ACL check when injecting schema.org contact data. This allows contact information for inaccessible contact items to be injected into schema.org snippets.

Joomla! Core has an XSS vulnerability through schema.org outputs. Improper escaping flags lead to an XSS vector in schema.org markup outputs.

Joomla! Core has an improper ACL check for custom fields webservice endpoints. Unauthorized users can create fields for inaccessible components.

Joomla! Core has an improper CORS origin validation. An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

Joomla! Core has a response header injection vulnerability in download views. Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.

Joomla! Core versions 1.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability of unrestricted uploads of SHTML files. The default list of dangerous files did not include SHTML files, which on servers that execute these files could lead to code execution.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have improper ACL checks for batch copy actions. An improper access check allows unauthorized users to perform copy batch operations on uneditable items.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have an MFA authentication bypass vulnerability. Insufficient state checks lead to a vector that allows bypassing 2FA checks.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have improper ACL checks for category webservice endpoints. An improper access check allows unauthorized users to create categories via webservices endpoints.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability related to inconsistent ACL checks for mutating webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives.

Lack of proper escaping in the update list view of the com_installer component in Joomla! leads to an XSS vulnerability. An attacker can inject malicious JavaScript code that will be executed in the administrator's browser.

Lack of proper escaping in the file management view of the com_templates component leads to a Cross-Site Scripting (XSS) vulnerability.

The com_jsjobs component in Joomla version 1.2.6 has an arbitrary file deletion vulnerability. Authenticated attackers can delete files by manipulating custom userfield parameters, sending POST requests with path traversal sequences in the field_2 parameter.

Lack of CSRF token validation in the admin activation endpoint of com_users leads to a CSRF attack vector. An attacker can trick an administrator into performing unauthorized actions.

Lack of output escaping leads to an XSS vector in the readmore links for com_content.

Lack of output escaping leads to an XSS vector in the content history component.

Lack of output escaping leads to an XSS vector in the multilingual associations component.