Archive for Joomla

285 results.

Top 10 PHP CMS Platforms For Developers in 2023

Mar01
by Ike on March 1, 2023 at 3:53 pm
Posted In: Joomla, most popular CMS, php cms, Plesk, Releases, Various, Wordpress

There are many types of Content Management System (CMS) on the market, and they’re all designed to help people create their own websites without programming training. While some systems are targeted at buyers with some knowledge of coding, most are aimed at website owners looking to build and maintain sites with maximum ease. As there is such a wide range of options, we’ll take a look at the main factors to consider when choosing from multiple CMS platforms below. What’s a CMS? CMS stands for Content Management System. It is a software application or platform that enables users to create,…

The post Top 10 PHP CMS Platforms For Developers in 2023 appeared first on Plesk.

└ Tags: , , , ,
 Comment 

The Day After Joomla 4.0 – Planning the Future

Aug26
by Ike on August 26, 2020 at 10:49 am
Posted In: CMS, Community, Joomla, Project Release News, Releases
The Day After Joomla 4.0 - Planning the Future

With Joomla 4.0 beta being released a few weeks ago, we enter into a phase of stabilization. Joomla! 4.0 is feature complete, that means, no new features are going to be added to Joomla 4.0. The focus is on fixing the last bugs to get Joomla! 4.0 out as soon as possible.

But what will happen until the release and afterwards? Obviously we don’t want to stop new feature development, which is why we would like to refine our development strategy for upcoming versions. Whenever we start the work on a new minor version, we plan to define the subsequent two minor releases This results in a more reliable release cycle and a more consistent road map.

└ Tags:
 Comment 

Joomla 3.9.21 Release

Aug25
by Ike on August 25, 2020 at 3:00 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 3.9.21

Joomla 3.9.21 is now available. This is a security release for the 3.x series of Joomla which addresses 3 security vulnerabilities and contains over 20 bug fixes and improvements.

└ Tags:
 Comment 

[20200802] – Core – Open redirect in com_content vote feature

Aug25
by Ike on August 25, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.20
  • Exploit type: Open Redirect
  • Reported Date: 2020-July-05
  • Fixed Date: 2020-August-25
  • CVE Number: CVE-2020-24598

Description

Lack of input validation in com_content leads to an open redirect.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.20

Solution

Upgrade to version 3.9.21

Contact

The JSST at the Joomla! Security Centre.

Reported By: Ahmad Kamaran Jamil

└ Tags:
 Comment 

[20200803] – Core – Directory traversal in com_media

Aug25
by Ike on August 25, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0-3.9.20
  • Exploit type: Directory Traversal
  • Reported Date: 2020-February-02
  • Fixed Date: 2020-August-25
  • CVE Number: CVE-2020-24597

Description

Lack of input validation allows com_media root paths outside of the webroot.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.20

Solution

Upgrade to version 3.9.21

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

└ Tags:
 Comment 

[20200801] – Core – XSS in mod_latestactions

Aug25
by Ike on August 25, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.9.0-3.9.20
  • Exploit type: XSS
  • Reported Date: 2020-August-21
  • Fixed Date: 2020-August-25
  • CVE Number: CVE-2020-24599

Description

Lack of escaping in mod_latestactions allows XSS attacks.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.20

Solution

Upgrade to version 3.9.21

Contact

The JSST at the Joomla! Security Centre.

Reported By: Peter Martin

└ Tags:
 Comment 

Joomla 4 Beta 3 is here and it comes with Joomla 3.10 Alpha 1

Jul29
by Ike on July 29, 2020 at 5:35 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 4.0.0 Beta 3 - Ready for a new world of possibilities. Use the hashtag #joomla4beta

The Joomla Project is pleased to announce the availability of the Joomla 4.0 Beta 3 release, and the first Alpha of Joomla 3.10.

└ Tags:
 Comment 

Joomla partners with Elastic Email for Transactional and Marketing mail sending

Jul21
by Ike on July 21, 2020 at 12:00 am
Posted In: CMS, Community, General News, Joomla, Releases
Elastic Email Partner

Joomla, one of the world’s most popular Content Management Systems (CMS), announced today its partnership with Elastic Email, a professional mail service provider for Transactional and Marketing related mails.

└ Tags:
 Comment 

Joomla 3.9.20 Release

Jul14
by Ike on July 14, 2020 at 3:00 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 3.9.20

Joomla 3.9.20 is now available. This is a security release for the 3.x series of Joomla which addresses 6 security vulnerabilities and contains over 25 bug fixes and improvements.

└ Tags:
 Comment 

[20200706] – Core – System Information screen could expose redis or proxy credentials

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.19
  • Exploit type: Information Disclosure
  • Reported Date: 2020-Jun-17
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15698

Description

Inadequate filtering in the system information screen could expose redis or proxy credentials

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

└ Tags:
 Comment 

[20200705] – Core – Escape mod_random_image link

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.19
  • Exploit type: XSS
  • Reported Date: 2020-Jun-08
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15696

Description

Lack of input filtering and escaping allows XSS attacks in mod_random_image

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

└ Tags:
 Comment 

[20200704] – Core – Variable tampering via user table class

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.0.0-3.9.19
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-Jun-02
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15697

Description

Internal read-only fields in the User table class could be modified by users.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Phil Taylor

└ Tags:
 Comment 

[20200703] – Core – CSRF in com_privacy remove-request feature

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.9.0-3.9.19
  • Exploit type: CSRF
  • Reported Date: 2020-May-07
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15695

Description

A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.9.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Bui Duc Anh Khoa from Viettel Cyber Security

└ Tags:
 Comment 

[20200702] – Core – Missing checks can lead to a broken usergroups table record

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0-3.9.19
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-April-04
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-15699

Description

Missing validation checks at the usergroups table object can result into an broken site configuration.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

└ Tags:
 Comment 

[20200701] – Core – CSRF in com_installer ajax_install endpoint

Jul14
by Ike on July 14, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.7.0-3.9.19
  • Exploit type: CSRF
  • Reported Date: 2020-May-07
  • Fixed Date: 2020-July-14
  • CVE Number: CVE-2020-XXXXX

Description

A missing token check in the ajax_install endpoint com_installer causes a CSRF vulnerability.

Affected Installs

Joomla! CMS versions 3.7.0 – 3.9.19

Solution

Upgrade to version 3.9.20

Contact

The JSST at the Joomla! Security Centre.

Reported By: Bui Duc Anh Khoa from Viettel Cyber Security

└ Tags:
 Comment 

Ready for a new world of possibilities? Joomla 4 Beta 2 is here

Jun30
by Ike on June 30, 2020 at 12:10 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 4.0.0 Beta 2 - Ready for a new world of possibilities. Use the hashtag #joomla4beta

The Joomla Project is pleased to announce the availability of the Joomla 4.0 Beta 2 release.

└ Tags:
 Comment 

Joomla 3.9.19 Release

Jun02
by Ike on June 2, 2020 at 3:00 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 3.9.19

Joomla 3.9.19 is now available. This is a security release for the 3.x series of Joomla which addresses 5 security vulnerabilities and contains over 40 bug fixes and improvements.

└ Tags:
 Comment 

[20200605] – Core – CSRF in com_postinstall

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.7.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-May-08
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-13760

Description

Missing token checks in com_postinstall cause CSRF vulnerabilities.

Affected Installs

Joomla! CMS versions 3.7.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Khoa Bùi Đức Anh

└ Tags:
 Comment 

[20200604] – Core – XSS in jQuery.htmlPrefilter

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Versions: 3.0.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-April-10
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-11022 and CVE-2020-11023

Description

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are “[…] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others.”

The Drupal project has backported the relevant fixes back to jQuery 1.x and Joomla has adopted that patch.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin, JSST

└ Tags:
 Comment 

[20200603] – Core – XSS in com_modules tag options

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-May-06
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-XXX

Description

Incorrect input validation of the module tag option in com_modules allow XSS attacks.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Lee Thao from Viettel Cyber Security

└ Tags:
 Comment 

[20200602] – Core – Inconsistent default textfilter settings

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0-3.9.18
  • Exploit type: Insecure Permissions
  • Reported Date: 2020-April-23
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-13763

Description

The default settings of the global “textfilter” configuration doesn’t block HTML inputs for ‘Guest’ users. With 3.9.19, the textfilter for new installations has been set to ‘No HTML’ for the groups ‘Public’, ‘Guest’ and ‘Registered’.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Brian Teeman

└ Tags:
 Comment 

[20200601] – Core – XSS in modules heading tag option

Jun02
by Ike on June 2, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 3.0.0-3.9.18
  • Exploit type: XSS
  • Reported Date: 2020-May-06
  • Fixed Date: 2020-June-02
  • CVE Number: CVE-2020-13761

Description

Lack of input validation in the heading tag option of the “Articles – Newsflash” and “Articles – Categories” modules allow XSS attacks.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

Reported By: Khoa Bùi Đức Anh

└ Tags:
 Comment 

Joomla 4.0 is on the horizon… the Beta is here

May30
by Ike on May 30, 2020 at 8:00 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 4.0.0 Beta - Ready for a new world of possibilities. Use the hashtag #joomla4beta

The Joomla Project is pleased to announce the availability of the Joomla 4.0 Beta release.

└ Tags:
 Comment 

Joomla 3.9.18 Release

Apr21
by Ike on April 21, 2020 at 8:00 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 3.9.18

Joomla 3.9.18 is now available. This is a bugfix release for the 3.x series of Joomla which addresses one bug.

└ Tags:
 Comment 

Joomla 3.9.17 Release

Apr21
by Ike on April 21, 2020 at 3:00 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 3.9.17

Joomla 3.9.17 is now available. This is a security release for the 3.x series of Joomla which addresses three security vulnerabilities and contains over 40 bug fixes and improvements.

└ Tags:
 Comment 

[20200403] – Core – Incorrect access control in com_users access level deletion function

Apr21
by Ike on April 21, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0 – 3.9.16
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-March-13
  • Fixed Date: 2020-April-21
  • CVE Number: CVE-2020-11889

Description

Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.16

Solution

Upgrade to version 3.9.17

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

└ Tags:
 Comment 

[20200402] – Core – Missing checks for the root usergroup in usergroup table

Apr21
by Ike on April 21, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Versions: 2.5.0 – 3.9.16
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-February-27
  • Fixed Date: 2020-April-21
  • CVE Number: CVE-2020-11890

Description

Inproper input validations in the usergroup table class could lead to a broken ACL configuration.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.16

Solution

Upgrade to version 3.9.17

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

└ Tags:
 Comment 

[20200401] – Core – Incorrect access control in com_users access level editing function

Apr21
by Ike on April 21, 2020 at 1:00 pm
Posted In: CMS, Joomla, security, Security Centre
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 3.8.8 – 3.9.16
  • Exploit type: Incorrect Access Control
  • Reported Date: 2020-March-13
  • Fixed Date: 2020-April-21
  • CVE Number: CVE-2020-11891

Description

Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.

Affected Installs

Joomla! CMS versions 3.8.8 – 3.9.16

Solution

Upgrade to version 3.9.17

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hoang Kien from VSEC

└ Tags:
 Comment 

Joomla partners with Report URI for real time Application Security and Health Monitoring

Mar30
by Ike on March 30, 2020 at 12:00 am
Posted In: CMS, Community, General News, Joomla, Releases
Report URI Partner

Joomla, one of the world’s most popular Content Management Systems (CMS), announced today its partnership with Report URI, the Application Security and Health Monitoring leader.

└ Tags:
 Comment 

Joomla 3.9.16 Release

Mar10
by Ike on March 10, 2020 at 3:00 pm
Posted In: CMS, Community, Joomla, Project Release News, Releases
Joomla 3.9.16

Joomla 3.9.16 is now available. This is a security release for the 3.x series of Joomla which addresses six security vulnerabilities and contains over 20 bug fixes and improvements.

└ Tags:
 Comment 

53 queries. 9.75 mb Memory usage. 1.501 seconds.