CVEs (405)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Lack of output escaping leads to a XSS vector in the multilingual associations component. |
Lack of output escaping leads to a XSS vector in the feed modules. |
An improper access check allows unauthorized access to webservice endpoints. |
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism. |
Lack of output escaping for article titles leads to XSS vectors in various locations. |
Lack of output escaping leads to a XSS vector in the multilingual associations component. |
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. |
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers. |
Lack of output escaping leads to a XSS vector in the pagebreak plugin. |
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. |
Insufficient state checks lead to a vector that allows to bypass 2FA checks. |
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages...Show more |
Improper Access Controls allows access to protected views. |
Lack of output escaping in the id attribute of menu lists. |
Various module chromes didn't properly process inputs, leading to XSS vectors. |
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. |
Improper Access Controls allows backend users to overwrite their username when disallowed. |
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. |
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. |
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. |