Joomla! Developer Network - Security News

1. [20110701] - XSS Vulnerability
   • Project: Joomla!
   • SubProject: All
   • Severity: Medium
   • Versions: 1.6.5 and all earlier 1.6.x versions
   • Exploit type: XSS
   • Reported Date: 2011-July-11
   • Fixed Date: 2011-July-19

   Description

   Inadequate escaping leads to XSS vulnerability.
   

   Affected Installs

   Joomla! version 1.6.5 and all earlier 1.6.x versions

   Solution

   Upgrade to the latest Joomla! version (1.6.6 or later)

   Reported by Aung Khant

   Contact

   The JSST at the Joomla! Security Center.

   

   
2. [20110601] - XSS Vulnerabilities
   • Project: Joomla!
   • SubProject: All
   • Severity: Medium
   • Versions: 1.6.3 and all earlier 1.6.x versions
   • Exploit type: XSS
   • Reported Date: 2011-March-24
   • Fixed Date: 2011-June-27

   Description

   Inadequate filtering leads to XSS vulnerability.
   

   Affected Installs

   Joomla! version 1.6.3 and all earlier 1.6.x versions

   Solution

   Upgrade to the latest Joomla! version (1.6.4 or later)

   Reported by Mesut Timur

   Contact

   The JSST at the Joomla! Security Center.

   

   
3. [20110603] - Unauthorised Access
   • Project: Joomla!
   • SubProject: All
   • Severity: Medium
   • Versions: 1.6.3 and all earlier 1.6.x versions
   • Exploit type: Unauthorised Access
   • Reported Date: 2011-June-10
   • Fixed Date: 2011-June-27

   Description

   Inadequate permission checking causes potential for unauthorised access.

   Affected Installs

   Joomla! version 1.6.3 and all earlier 1.6.x versions

   Solution

   Upgrade to the latest Joomla! version (1.6.4 or later)

   Reported by Mark Dexter

   Contact

   The JSST at the Joomla! Security Center.

   

   
4. [20110602] - Information Disclosure
   • Project: Joomla!
   • SubProject: All
   • Severity: Low
   • Versions: 1.6.3 and all earlier 1.6.x versions
   • Exploit type: Information Disclosure
   • Reported Date: 2011-May-25
   • Fixed Date: 2011-June-23

   Description

   Inadequate filtering causes possible information disclosure.
   

   Affected Installs

   Joomla! version 1.6.3 and all earlier 1.6.x versions

   Solution

   Upgrade to the latest Joomla! version (1.6.4 or later)

   Reported by Aung Khant

   Contact

   The JSST at the Joomla! Security Center.

   

   
5. [20110604] - XSS Vulnerability
   • Project: Joomla!
   • SubProject: All
   • Severity: Medium
   • Versions: 1.6.3 and all earlier 1.6.x versions
   • Exploit type: XSS
   • Reported Date: 2011-May-25
   • Fixed Date: 2011-June-27

   Description

   Inadequate filtering leads to XSS vulnerability.
   

   Affected Installs

   Joomla! version 1.6.3 and all earlier 1.6.x versions

   Solution

   Upgrade to the latest Joomla! version (1.6.4 or later)

   Reported by Aung Khant

   Contact

   The JSST at the Joomla! Security Center.