SQL Injection vulnerability in extension Developer Log (devlog)

It has been discovered that the extension "Developer Log" devlog is susceptible to SQL Injection Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 2.11.3 and below Vulnerability Type: SQL...

SQL Injection vulnerability in extension Store Locator (locator)

It has been discovered that the extension "Store Locator" locator is susceptible to SQL Injection Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 3.3.0 and below Vulnerability Type: SQL...

Authentication Bypass in TYPO3 CMS 4.5

It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass. Component Type: TYPO3 CMS Vulnerability Types: Authentication Bypass Overall Severity: Critical Release Date: February 19, 2015 Bulletin Update: February 23, 2015 added CVE Vulnerable subcomponent: rsaauth system...

Cross-Site Scripting in extension Gridelements (gridelements)

It has been discovered that the extension "gridelements" gridelements is susceptible to Cross-Site Scripting Release Date: February 17, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: gridelements: Versions 3.0.0, 2.1....

Information Disclosure in Direct Mail Subscription (direct_mail_subscription)

It has been discovered that the extension "Direct Mail Subscription" directmailsubscription is susceptible to Information Disclosure. Release Date: January 16, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 2.0.1...

Multiple vulnerabilities in Content Rating (content_rating)

It has been discovered that the extension "Content Rating" contentrating is susceptible to Cross-Site Scripting and SQL Injection. Release Date: January 9, 2015 Bulletin Update: February 23, 2015 added CVEs Component Type: Third party extension. This extension is not a part of the TYPO3 default...

Multiple vulnerabilities in Content Rating Extbase (content_rating_extbase)

It has been discovered that the extension "Content Rating Extbase" contentratingextbase is susceptible to Cross-Site Scripting and SQL Injection. Release Date: January 9, 2015 Bulletin Update: February 23, 2015 added CVEs Component Type: Third party extension. This extension is not a part of the...

Improper Authentication in LDAP / SSO Authentication (ig_ldap_sso_auth)

It has been discovered that the extension "LDAP / SSO Authentication" igldapssoauth is susceptible to Improper Authentication. Release Date: January 8, 2015 Bulletin Update: January 8, 2015 Affected Versions, Severity; February 23, 2015 added CVE Component Type: Third party extension. This...

Multiple vulnerabilities in Drag Drop Mass Upload (ameos_dragndropupload)

It has been discovered that the extension "Drag Drop Mass Upload" ameosdragndropupload is susceptible to Cross-Site Scripting, Cross-Site Request Forgery and Improper Access Control. Release Date: December 15, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3...

Cross-Site Scripting vulnerability in wfGallery (wf_gallery)

It has been discovered that the extension "wfGallery" wfgallery is susceptible to Cross-Site Scripting. Release Date: December 15, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 1.0.3 and all versions below...

Multiple vulnerabilities in BibTex Publications (si_bibtex)

It has been discovered that the extension "BibTex Publications" sibibtex is susceptible to Cross-Site Scripting and SQL Injection. Release Date: December 15, 2014 Bulletin Update: January 9, 2015 added CVEs Component Type: Third party extension. This extension is not a part of the TYPO3 default...

Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to Cross-Site Scripting, Denial of Service and Local File Inclusion. Release Date: December 8, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected...

Improper Access Control in WebDav for filemounts (webdav)

It has been discovered that the extension "WebDav for filemounts" webdav is susceptible to Improper Access Control. Release Date: November 27, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 2.0.0 Vulnerability Type:...

Cross-Site Scripting vulnerability in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to Cross-Site Scripting. Release Date: November 5, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 4.18.0, 4.18.1, 4.18.2 and 4.18.3...

Improper Access Control vulnerability in extension fal_sftp (fal_sftp)

It has been discovered that the extension "falsftp" falsftp is susceptible to Improper Access Control. Release Date: October 17, 2014 Bulletin Update: October 18, 2014 added CVE Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Version...

Denial of Service vulnerability in extension Calendar Base (cal)

It has been discovered that the extension "Calendar Base" cal is susceptible to Denial of Service. Release Date: October 17, 2014 Bulletin Update: October 18, 2014 added CVE Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: a...

Information Disclosure vulnerability in Dynamic Content Elements (dce)

It has been discovered that the extension "Dynamic Content Elements" dce is susceptible to Information Disclosure. Release Date: October 17, 2014 Bulletin Update: October 18, 2014 added CVE Component Type: Third party extension. This extension is not a part of the TYPO3 default installation...

Cross-Site Scripting in news

It has been discovered that the extension "News system" news is susceptible to Cross-Site Scripting Release Date: June 3, 2014 Bulletin update: September 4, 2014 affected version clarification Component Type: Third party extension. This extension is not a part of the TYPO3 default installation...

Cross-Site Scripting in gridelements

It has been discovered that the extension "Grid Elements" gridelements is susceptible to Cross-Site Scripting Release Date: May 27, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 2.0.2 and below, 1.5.0 and below...

Arbitrary code execution in extension "powermail" (powermail)

It has been discovered that the extension "powermail" powermail is susceptible to arbitrary code execution and Cross-Site Scripting Release Date: May 22, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: powermail:...