Environment Variable Injection in extension "Amazon AWS S3 FAL driver (CDN)" (aus_driver_amazon_s3)

The extension uses an old version of the third party library guzzlehttp/guzzle, which is known to be vulnerable against the HTTPOXY attack. Read or for further details...

TYPO3 CAB FAL Search Extension Cross-Site Scripting Attack Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. An unspecified cross-site scripting attack vulnerability exists in TYPO3's CAB FAL search extension, which stems from insufficient validation of user input. The vulnerability can...

PT-2014-8472

Name of the Vulnerable Software and Affected Versions TYPO3 fal sftp extension versions prior to 0.2.6 Description The issue allows remote authenticated users to obtain sensitive information due to weak permissions for sFTP driver files and folders. Recommendations For versions prior to 0.2.6,...

Design/Logic Flaw

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL...

CVE-2013-4320

The data shows a TYPO3 File Abstraction Layer (FAL) vulnerability (CVE-2013-4320) affecting TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4, caused by improper permission checks in FAL that permit remote authenticated users to create or read arbitrary files via a crafted URL. Connected sources al...

CVE-2013-4321

The vulnerability concerns TYPO3’s File Abstraction Layer (FAL) in TYPO3 6.0.x (before 6.0.8/6.0.9) and 6.1.x (before 6.1.4) where remote authenticated editors can execute arbitrary PHP code by using unspecified characters in the file extension when renaming a file. This issue is a consequence of...