a:3:{s:5:"child";a:1:{s:0:"";a:1:{s:3:"rss";a:1:{i:0;a:6:{s:4:"data";s:0:"";s:7:"attribs";a:1:{s:0:"";a:1:{s:7:"version";s:3:"2.0";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:1:{s:0:"";a:1:{s:7:"channel";a:1:{i:0;a:6:{s:4:"data";s:50:"
		
		
		
		
		
		
		
		
		
		
		
		
		
		
		
		
	";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:3:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:38:"Joomla! Developer - Vulnerability News";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:274:"Not only is Joomla! easy to use, but it is easy to add extra functionality through a flexible and powerful developer framework. The Joomla! Framework allows you to build exceptional extensions for Joomla! including components, modules, plugins, templates and language packs.";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:46:"http://developer.joomla.org/security/news.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:13:"lastBuildDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Fri, 24 Jul 2009 17:04:19 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:9:"generator";a:1:{i:0;a:5:{s:4:"data";s:44:"Joomla! 1.5 - Open Source Content Management";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"language";a:1:{i:0;a:5:{s:4:"data";s:5:"en-gb";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"item";a:10:{i:0;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:39:"[20090722] - Core - Missing JEXEC Check";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:103:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/HiUGdggCF-M/302-20090722-core-missing-jexec-check.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:84:"http://developer.joomla.org/security/news/302-20090722-core-missing-jexec-check.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1238:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> Framework</li>
 <li><strong>Severity: </strong>Moderate</li>
 <li><strong>Versions:</strong> 1.5.12 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> Path Disclosure</li>
 <li><strong>Reported Date:</strong> 2009-July-21</li>
 <li><strong>Fixed Date:</strong> 2009-July-22</li>
</ul>
<h2>Description</h2>
<p>Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.12 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.13 or newer).</p>
<p>Reported by Juan Galiana Lara (Internet Security Auditors)</p>
<h2>Contact</h2>
<p>The JSST at the <a title="Contact the JSST" href="http://developer.joomla.org/security.html">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=HiUGdggCF-M:KZ37xDySTLE:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/HiUGdggCF-M" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:36:"dextercowley@gmail.com (Mark Dexter)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 22 Jul 2009 23:36:40 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:84:"http://developer.joomla.org/security/news/302-20090722-core-missing-jexec-check.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:1;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:31:"[20090722] - Core - File Upload";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:95:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/rhefmqvY3kw/301-20090722-core-file-upload.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:76:"http://developer.joomla.org/security/news/301-20090722-core-file-upload.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1135:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> TinyMCE editor</li>
 <li><strong>Severity: </strong>Critical</li>
 <li><strong>Versions:</strong> 1.5.12</li>
 <li><strong>Exploit type:</strong> Image File upload</li>
 <li><strong>Reported Date:</strong> 2009-July-22</li>
 <li><strong>Fixed Date:</strong> 2009-July-22</li>
</ul>
<h2>Description</h2>
<p>Tiny browser included with TinyMCE 3.0 editor allowed files to be uploaded and removed without logging in.</p>
<h2>Affected Installs</h2>
<p>Version 1.5.12 only</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.13 or newer).</p>
<p>Reported by Patrice Lazareff.</p>
<h2>Contact</h2>
<p>The JSST at the <a title="Contact the JSST" href="http://developer.joomla.org/security.html">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=rhefmqvY3kw:yPlGvByBTag:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/rhefmqvY3kw" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:36:"dextercowley@gmail.com (Mark Dexter)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 22 Jul 2009 23:17:38 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:76:"http://developer.joomla.org/security/news/301-20090722-core-file-upload.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:2;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:39:"[20090606] - Core - Missing JEXEC Check";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:103:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/tdX89H7fxHg/300-20090606-core-missing-jexec-check.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:84:"http://developer.joomla.org/security/news/300-20090606-core-missing-jexec-check.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1169:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> Admin client</li>
 <li><strong>Severity: </strong>Moderate</li>
 <li><strong>Versions:</strong> 1.5.11 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> XSS</li>
 <li><strong>Reported Date:</strong> 2009-June-22</li>
 <li><strong>Fixed Date:</strong> 2009-June-30</li>
</ul>
<h2>Description</h2>
<p>Some files were missing the check for JEXEC.&nbsp; These scripts will then expose internal path information of the host.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.11 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.12 or newer).</p>
<h2>Contact</h2>
<p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=tdX89H7fxHg:Q3M2PUgXU9I:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/tdX89H7fxHg" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:36:"dextercowley@gmail.com (Mark Dexter)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 01 Jul 2009 04:46:19 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:84:"http://developer.joomla.org/security/news/300-20090606-core-missing-jexec-check.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:3;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:65:"[20090605] - Core - Frontend XSS - PHP_SELF not properly filtered";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:126:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/rXu7-1-yikY/299-20090605-core-frontend-xss-phpself-not-properly-filtered.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:107:"http://developer.joomla.org/security/news/299-20090605-core-frontend-xss-phpself-not-properly-filtered.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1207:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> Site client</li>
 <li><strong>Severity: </strong>Moderate</li>
 <li><strong>Versions:</strong> 1.5.11 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> XSS</li>
 <li><strong>Reported Date:</strong> 2009-June-03</li>
 <li><strong>Fixed Date:</strong> 2009-June-30</li>
</ul>
<h2>Description</h2>
<p>An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.11 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.12 or newer).</p>
<p>Reported By Paul Boekholt (Byte Internet)</p>
<h2>Contact</h2>
<p>The JSST at the <a title="Contact the JSST" href="http://developer.joomla.org/security.html">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=rXu7-1-yikY:i1QfQVH-7U0:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/rXu7-1-yikY" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:36:"dextercowley@gmail.com (Mark Dexter)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 01 Jul 2009 04:46:06 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:107:"http://developer.joomla.org/security/news/299-20090605-core-frontend-xss-phpself-not-properly-filtered.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:4;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:69:"[20090604] - Core - Frontend XSS - HTTP_REFERER not properly filtered";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:130:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/CNWiGeg0768/298-20090604-core-frontend-xss-httpreferer-not-properly-filtered.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:111:"http://developer.joomla.org/security/news/298-20090604-core-frontend-xss-httpreferer-not-properly-filtered.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1310:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> Site client</li>
 <li><strong>Severity: </strong>Moderate</li>
 <li><strong>Versions:</strong> 1.5.11 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> XSS</li>
 <li><strong>Reported Date:</strong> 2009-June-30</li>
 <li><strong>Fixed Date:</strong> 2009-June-30</li>
</ul>
<h2>Description</h2>
<p>An attacker can inject JavaScript or DHTML code that will be executed in the context of targeted user browser, allowing the attacker to steal cookies. HTTP_REFERER variable is not properly parsed.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.11 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.12 or newer).</p>
<p>Reported by Juan Galiana Lara (Internet Security Auditors)</p>
<h2>Contact</h2>
<p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=CNWiGeg0768:GWjZvpyyROg:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/CNWiGeg0768" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:36:"dextercowley@gmail.com (Mark Dexter)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 01 Jul 2009 04:45:53 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:111:"http://developer.joomla.org/security/news/298-20090604-core-frontend-xss-httpreferer-not-properly-filtered.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:5;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:32:"[20090603] - Core - Frontend XSS";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:96:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/ldmL-NGeZcc/297-20090602-core-frontend-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:77:"http://developer.joomla.org/security/news/297-20090602-core-frontend-xss.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1189:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> Site client</li>
 <li><strong>Severity: </strong>Low</li>
 <li><strong>Versions:</strong> 1.5.10 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> XSS</li>
 <li><strong>Reported Date:</strong> 2009-May-05</li>
 <li><strong>Fixed Date:</strong> 2009-June-02</li>
</ul>
<h2>Description</h2>
<p>Some values were output from the database without being properly escaped.&nbsp; Most strings in question were sourced from the administrator panel.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.10 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.11 or newer).</p>
<h2>Contact</h2>
<p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=ldmL-NGeZcc:WJIYCXw0Txw:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/ldmL-NGeZcc" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:45:"ian.maclennan@help.joomla.org (Ian MacLennan)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 03 Jun 2009 05:56:53 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:77:"http://developer.joomla.org/security/news/297-20090602-core-frontend-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:6;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:33:"[20090602] - Core - ja_purity XSS";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:96:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/4fa0j__1ZM0/296-20090602-core-japurity-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:77:"http://developer.joomla.org/security/news/296-20090602-core-japurity-xss.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1167:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> ja_purity</li>
 <li><strong>Severity: </strong>Moderate</li>
 <li><strong>Versions:</strong> 1.5.10 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> XSS</li>
 <li><strong>Reported Date:</strong> 2009-April-06</li>
 <li><strong>Fixed Date:</strong> 2009-June-02</li>
</ul>
<h2>Description</h2>
<p>A XSS vulnerability exists in the JA_Purity template which ships with Joomla! 1.5.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.10 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.11 or newer).</p>
<p>Reported by Juan Galiana Lara.</p>
<h2>Contact</h2>
<p>The JSST at the <a title="Contact the JSST" href="http://developer.joomla.org/security.html">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=4fa0j__1ZM0:JJqzfQfCnpY:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/4fa0j__1ZM0" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:45:"ian.maclennan@help.joomla.org (Ian MacLennan)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 03 Jun 2009 05:56:42 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:77:"http://developer.joomla.org/security/news/296-20090602-core-japurity-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:7;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:33:"[20090601] - Core - com_users XSS";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:96:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/xUZi_R8Y6GU/295-20090601-core-comusers-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:77:"http://developer.joomla.org/security/news/295-20090601-core-comusers-xss.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1165:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> com_users</li>
 <li><strong>Severity: </strong>Moderate</li>
 <li><strong>Versions:</strong> 1.5.10 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> XSS</li>
 <li><strong>Reported Date:</strong> 2009-April-30</li>
 <li><strong>Fixed Date:</strong> 2009-June-02</li>
</ul>
<h2>Description</h2>
<p>A XSS vulnerability exists in the user view of com_users in the administrator panel.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.10 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.11 or newer).</p>
<p>Reported by Airton Torres.</p>
<h2>Contact</h2>
<p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=xUZi_R8Y6GU:CaHJHkypCnI:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/xUZi_R8Y6GU" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:45:"ian.maclennan@help.joomla.org (Ian MacLennan)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 03 Jun 2009 05:56:25 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:77:"http://developer.joomla.org/security/news/295-20090601-core-comusers-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:8;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:35:"[20090302] - Core - com_content XSS";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:98:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/b6QqXDkfSfE/294-20090302-core-comcontent-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:79:"http://developer.joomla.org/security/news/294-20090302-core-comcontent-xss.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1108:"<ul>  <li><strong>Project:</strong> Joomla!</li>  <li><strong>SubProject:</strong> com_content</li>  <li><strong>Severity: </strong>Low</li>  <li><strong>Versions:</strong> 1.5.9 and all previous 1.5 releases</li>  <li><strong>Exploit type:</strong> XSS </li>  <li><strong>Reported Date:</strong> 2009-March-12</li>  <li><strong>Fixed Date:</strong> 2009-March-27</li> </ul> <h2>Description</h2> <p>A XSS vulnerability exists in the category view of com_content. </p> <h2>Affected Installs</h2> <p>All 1.5.x installs prior to and including 1.5.9 are affected.</p> <h2>Solution</h2> <p>Upgrade to latest Joomla! version (1.5.10 or newer).</p> <h2>Contact</h2> <p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=b6QqXDkfSfE:tJuPRIDqga4:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/b6QqXDkfSfE" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 25 Mar 2009 17:08:07 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:79:"http://developer.joomla.org/security/news/294-20090302-core-comcontent-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:9;a:6:{s:4:"data";s:31:"
			
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:37:"[20090301] - Core - Multiple XSS/CSRF";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:100:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/Hm6QFA90lns/293-20090301-core-multiple-xsscsrf.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:81:"http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html";s:7:"attribs";a:1:{s:0:"";a:1:{s:11:"isPermaLink";s:5:"false";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1448:"<ul>  <li><strong>Project:</strong> Joomla!</li>  <li><strong>SubProject:</strong> Multiple</li>  <li><strong>Severity: </strong>Moderate</li>  <li><strong>Versions:</strong> 1.5.9 and all previous 1.5 releases</li>  <li><strong>Exploit type:</strong> XSS and CSRV </li>  <li><strong>Reported Date:</strong> 2009-February-15</li>  <li><strong>Fixed Date:</strong> 2009-March-27</li> </ul> <h2>Description</h2> <p>A series of XSS and CSRF faults exist in the administrator application.  Affected administrator components include com_admin, com_media, com_search.  Both com_admin and com_search contain XSS vulnerabilities, and com_media contains 2 CSRF vulnerabilities.  </p> <h2>Affected Installs</h2> <p>All 1.5.x installs prior to and including 1.5.9 are affected.  The com_search XSS vulnerability requires that "Gather Search Statistics" be enabled to be exploitable (Disabled by default). </p> <h2>Solution</h2> <p>Upgrade to latest Joomla! version (1.5.10 or newer).</p> <h2>Contact</h2> <p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=Hm6QFA90lns:GmmjJX81OIU:yIl2AUoC8zA"><img src="http://feeds.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/JoomlaSecurityNews/~4/Hm6QFA90lns" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 25 Mar 2009 17:02:52 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:81:"http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}}}s:27:"http://www.w3.org/2005/Atom";a:1:{s:4:"link";a:2:{i:0;a:5:{s:4:"data";s:0:"";s:7:"attribs";a:1:{s:0:"";a:3:{s:3:"rel";s:4:"self";s:4:"href";s:42:"http://feeds.joomla.org/JoomlaSecurityNews";s:4:"type";s:19:"application/rss+xml";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}i:1;a:5:{s:4:"data";s:0:"";s:7:"attribs";a:1:{s:0:"";a:2:{s:3:"rel";s:3:"hub";s:4:"href";s:31:"http://pubsubhubbub.appspot.com";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:2:{s:14:"emailServiceId";a:1:{i:0;a:5:{s:4:"data";s:18:"JoomlaSecurityNews";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:18:"feedburnerHostname";a:1:{i:0;a:5:{s:4:"data";s:28:"http://feedburner.google.com";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}}}}}}}}s:7:"headers";a:9:{s:13:"last-modified";s:29:"Fri, 24 Jul 2009 17:04:26 GMT";s:4:"etag";s:27:"8y6FUrgcTEd0Xcp4MALZyld9N88";s:12:"content-type";s:23:"text/xml; charset=UTF-8";s:4:"date";s:29:"Fri, 24 Jul 2009 17:14:35 GMT";s:7:"expires";s:29:"Fri, 24 Jul 2009 17:14:35 GMT";s:13:"cache-control";s:18:"private, max-age=0";s:22:"x-content-type-options";s:7:"nosniff";s:6:"server";s:7:"GFE/2.0";s:17:"transfer-encoding";s:7:"chunked";}s:5:"build";i:20070719221955;}