typo3-{11,12} -- multiple vulnerabilities

Typo3 developers reports: All versions are security releases and contain important security fixes - read the corresponding security advisories here: Path Traversal in TYPO3 File Abstraction Layer Storages CVE-2023-30451 Code Execution in TYPO3 Install Tool CVE-2024-22188 Information Disclosure of...

TYPO3 vulnerable to remote authenticated arbitrary code execution

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250...

TYPO3 Improper Access Management in the File Abstraction Layer

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL...

GHSA-P9JG-9W87-6RG4 TYPO3 Improper Access Management in the File Abstraction Layer

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL...

Arbitrary File Upload

Overview typo3/cms is a free open source Content Management Framework. Affected versions of this package are vulnerable to Arbitrary File Upload due to improper checks on file extensions in the file upload component and File Abstraction Layer. Remediation Upgrade typo3/cms to version 6.0.8, 6.1.3...

GHSA-54JJ-PXX2-PV8H TYPO3 doesn't properly check file extensions

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

TYPO3 doesn't properly check file extensions

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

CVE-2021-38623

The deferredimageprocessing aka Deferred image processing extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption...

CVE-2021-38623

The deferredimageprocessing aka Deferred image processing extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Typo3 association.TYPO3 has a denial of service vulnerability that can be exploited by attackers to cause a denial of service via the FAL API...

CVE-2013-4321

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250...

CVE-2013-4320

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL...

CVE-2013-4250

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

Design/Logic Flaw

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

Design/Logic Flaw

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250...

CVE-2013-4320

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL...

CVE-2013-4321

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250...

CVE-2013-4321

The vulnerability concerns TYPO3’s File Abstraction Layer (FAL) in TYPO3 6.0.x (before 6.0.8/6.0.9) and 6.1.x (before 6.1.4) where remote authenticated editors can execute arbitrary PHP code by using unspecified characters in the file extension when renaming a file. This issue is a consequence of...

CVE-2013-4320

The data shows a TYPO3 File Abstraction Layer (FAL) vulnerability (CVE-2013-4320) affecting TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4, caused by improper permission checks in FAL that permit remote authenticated users to create or read arbitrary files via a crafted URL. Connected sources al...

TYPO3 File Abstraction Layer Multiple Vulnerabilities

TYPO3 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; ifdescription...