Benjamin Trenkle

**Nome do software vulnerável e versões afetadas** Joomla! versões 1.7.0 a 3.9.22 **Descrição** Foi detectada uma falha no Joomla! devido à falta de validação de entradas durante o processamento de conjuntos de regras ACL, o que pode causar violações de ACL de gravação. **Recomendações** Para as versões 1.7.0 a 3.9.22, atualize para uma versão que contenha uma correção para este problema. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions 3.9.7 through 3.9.8 **Description** The issue allows users authorized to create custom fields to manipulate filtering options and inject unvalidated options, potentially leading to remote code execution due to inadequate filtering in subform fields. **Recommendations** For versions 3.9.7 and 3.9.8, update to version 3.9.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.9.5 **Description** An issue was discovered where the "refresh list of helpsites" endpoint of com users lacks access checks, allowing calls from unauthenticated users. This affects the com users component, specifically the endpoint related to refreshing the list of helpsites. **Recommendations** For versions prior to 3.9.5, update to version 3.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "refresh list of helpsites" endpoint of com users to authenticated users only until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.9.4 **Description** An issue was discovered that allows unauthorized access due to the lack of ACL checks in the sample data plugins. **Recommendations** For versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions prior to 3.8.8 **Description** An issue in com fields allows users authorized to create custom fields to manipulate filtering options and inject unvalidated options due to inadequate filtering. **Recommendations** For versions prior to 3.8.8, update to version 3.8.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.8.4 **Description** The issue is related to inadequate input filtering in com fields, which leads to an XSS vulnerability in multiple field types, including list, radio, and checkbox. **Recommendations** For versions prior to 3.8.4, update to version 3.8.4 or later to resolve the issue.