145 matches found
GHSA-P48W-VF3C-RQJX Cross-Site Scripting in Bootstrap Package
Problem It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. The following templates are affected by the vulnerability:...
CVE-2021-21365
Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custo...
CVE-2021-21365
Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custo...
CVE-2021-21380
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform and only those with the Ratings API installed, the Rating Script Service expose an API to perform SQL requests without escaping the from and where search...
CVE-2021-21380 Rating Script Service expose XWiki to SQL injection
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform and only those with the Ratings API installed, the Rating Script Service expose an API to perform SQL requests without escaping the from and where search...
openSUSE Security Update : MozillaThunderbird (openSUSE-2021-387)
This update for MozillaThunderbird fixes the following issues : - Mozilla Thunderbird 78.8 - fixed: Importing an address book from a CSV file always reported an error - fixed: Security information for S/MIME messages was not displayed correctly prior to a draft being saved - fixed: Calendar:...
Security update for MozillaThunderbird (important)
openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2021:0387-1 Rating: important References: 1182357 1182614 Cross-References: CVE-2021-23968 CVE-2021-23969 CVE-2021-23973 CVE-2021-23978 CVSS scores: CVE-2021-23968 NVD : 4.3...
Potential Remote Code Execution in TYPO3 with mediace extension
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 9.1 CWE-325, CWE-20, CWE-200, CWE-502 Problem It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message...
Cross-Site Scripting in SVG Sanitizer
Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. An updated version 1.0.3 is available from the TYPo3 extension manager and at...
GHSA-59CF-M7V5-WH5W Cross-Site Scripting in SVG Sanitizer
Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. An updated version 1.0.3 is available from the TYPo3 extension manager and at...
TYPO3 Path Traversal Vulnerability
TYPO3 is a free and open source content management system written in PHP under the GNU General Public License. A path traversal vulnerability exists in the extraction of manually uploaded ZIP archive files in Extension Manager in TYPO3 versions prior to 8.7.30, 9.x versions prior to 9.5.12, and...
CVE-2019-19848
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. ...
CVE-2019-19848
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. ...
Directory traversal
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. ...
CVE-2019-19848
TYPO3 Directory Traversal (CVE-2019-19848): Affects TYPO3 8.x < 8.7.30, 9.x < 9.5.12, and 10.x
CVE-2019-19848
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. ...
Directory Traversal on ZIP extraction
It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal...
PT-2019-15979 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 8.7.30 TYPO3 versions 9.x prior to 9.5.12 TYPO3 versions 10.x prior to 10.2.2 Description: An issue has been discovered in the extraction of manually uploaded ZIP archives in the Extension Manager, which is vulnerable ...
TYPO3 cross-site scripting vulnerability (CNVD-2019-40299)
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in Extension Manager in TYPO3. The vulnerability stems from the lack of proper validation of client-side data in the WEB application, which can b...