TYPO3 Job Fair Arbitrary File Upload Vulnerability

TYPO3 is a free and open source content management system, Job Fair is a marketplace work extension plugin based on Extbase and Fluid. An arbitrary file upload vulnerability exists in TYPO3 Job Fair, which allows remote attackers to exploit the vulnerability to submit a special file and execute i...

CVE-2015-1404

Cross-site scripting XSS vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1404

Cross-site scripting XSS vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1405

CVE-2015-1405 affects the TYPO3 Content Rating Extbase extension (component: content_rating_extbase) for TYPO3, specifically versions 2.0.3 and earlier. The weakness is an SQL injection vulnerability that allows a remote attacker to execute arbitrary SQL commands via unspecified vectors. The rela...

CVE-2015-1404

TYPO3 Content Rating Extbase extension (content_rating_extbase) vulnerable: versions 2.0.3 and older are affected. Root cause is improper escaping of user input in HTML and SQL contexts, enabling Cross-Site Scripting (XSS) and SQL Injection as described in TYPO3 security bulletin TYPO3-EXT-SA-201...

CVE-2015-1405: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-1404: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Multiple Input Validation Vulnerabilities in TYPO3 Content Rating Extbase Extension

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. Multiple input validation vulnerabilities exist in the TYPO3 Content Rating Extbase Extension, which can be exploited by attackers to steal cookie-based authentication credential...

Multiple vulnerabilities in Content Rating Extbase (content_rating_extbase)

It has been discovered that the extension "Content Rating Extbase" contentratingextbase is susceptible to Cross-Site Scripting and SQL Injection. Release Date: January 9, 2015 Bulletin Update: February 23, 2015 added CVEs Component Type: Third party extension. This extension is not a part of the...

CVE-2014-6289

The Ajax dispatcher for Extbase in the Yet Another Gallery yag extension before 3.0.1 and Tools for Extbase development ptextbase extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors...

Authentication flaw

The Ajax dispatcher for Extbase in the Yet Another Gallery yag extension before 3.0.1 and Tools for Extbase development ptextbase extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors...

CVE-2014-6289

The CVE-2014-6289 issue affects TYPO3 extensions Yet Another Gallery (yag) and Tools for Extbase development (pt_extbase). The Ajax dispatcher for Extbase in yag (<=3.0.0) and pt_extbase (

CVE-2014-6289

The Ajax dispatcher for Extbase in the Yet Another Gallery yag extension before 3.0.1 and Tools for Extbase development ptextbase extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors...

CVE-2014-6289: Undefined Security Weakness

The Ajax dispatcher for Extbase in the Yet Another Gallery yag extension before 3.0.1 and Tools for Extbase development ptextbase extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors...

CVE-2014-3946

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors...

CVE-2014-3946

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors...

Design/Logic Flaw

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors...

CVE-2014-3946

The CVE-2014-3946 issue affects TYPO3’s Extbase Framework component, specifically TYPO3 6.2.0 before 6.2.3. The vulnerability arises from improper validation of group permissions within the query caching functionality, enabling remote authenticated users to read arbitrary queries via unspecified ...