Joomla! reported the following vulnerabilities:
If a user entered a URL with a negative query limit
or offset, a PHP notice would display revealing information
about the system..
The migration script in the Joomla! installer does not
check the file type being uploaded. If the installation
application is present, an attacker could use it to
upload malicious files to a server.
Session id doesn't get modified when user logs in. A
remote site may be able to forward a visitor to the
Joomla! site and set a specific cookie. If the user
then logs in, the remote site can use that cookie to
authenticate as that user.
When a user requests a password reset, the reset tokens
were stored in plain text in the database. While this
is not a vulnerability in itself, it allows user accounts
to be compromised if there is an extension on the site
with an SQL injection vulnerability.