CVEs (395)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
An improper access check allows unauthorized users to create custom fields via webservices endpoints. |
An improper access check allows unauthorized users to access com_privacy datasets. |
An improper access check allows users to display a list of modules in the frontend. |
An improper access check allows unauthorized users to access workflow stage and transition information. |
Improper validation leads to a generic XSS vector in the language override feature. |
Lack of escaping leads to an XSS vulnerability in the generic image output layout. |
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. |
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. |
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. |
Lack of validation leads to an XSS vulnerability in the MFA management views. |
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. |
An improper access check allows privileged users to overwrite media files without editing permissions. |
Lack of input filtering leads to an XSS vector in the HTML filter code. |
An improper access check allows privelege escalation through the com_users group editing webservice endpoint. |
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components. |
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. |
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key. |
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks. |
An improper access check allows privilege escalation through the com_users batch task. |
An improper access check allows privilege escalation through the com_users batch task. |