PT-2024-40019 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue concerns the handling of online media assets, specifically .youtube and .vimeo files, in the TYPO3 backend. It is vulnerable to a denial of service, which occurs when large files wi...

PT-2024-40517 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns the backend API configuration using Page TSconfig, which is susceptible to arbitrary code execution and cross-site scripting. An attacker can inject malicious...

PT-2024-40269 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue allows backend users to upload certain file types, including .phar, .shtml, .pl, or .cgi files, due to missing file extensions in the $GLOBALS'TYPO3 CONF VARS''BE''fileDenyPattern'...

PT-2024-40511 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, so: Software affected versions not specified Description: A security issue allows backend users without read access to specific pages to still view them in the page tree, which should be disallowed...

PT-2024-40076 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: Typo3 affected versions not specified Description: A cross-site scripting issue has been found in the handling of t3:// URL and typolink functionality. This affects not only regular backend forms but also frontend extensions that use renderin...

PT-2024-40462 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The element information component is susceptible to information disclosure due to improper permission checks for backend users. A valid backend user account is required to exploit...

PT-2024-40213 · Unknown +1 · Form Framework +1

Name of the Vulnerable Software and Affected Versions: Form Framework system extension form affected versions not specified Description: The issue concerns Insecure Deserialization in the Form Framework when used with the PHP PECL package yaml. This package can unserialize YAML contents to PHP...

PT-2024-40190 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or version information is provided. Description: The issue arises from improper encoding of user input, making the login status display susceptible to cross-site scripting in the website frontend. To exploit this, a valid...

PT-2024-40463 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue arises when creating new backend user accounts in the TYPO3 backend, potentially leading to database records with insecure or empty credentials being persisted. This occurs when the...

PT-2024-40355 · Packagist · Typo3/Cms

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned Description: The issue concerns a brute force protection mechanism in the backend login system. This mechanism pauses for 5 seconds when incorrect credentials are provided. However, it is possible to...

PT-2024-40503 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: Typo3 affected versions not specified Description: The issue concerns cross-site scripting vulnerabilities in two separate areas. Firstly, the typolink functionality in the website's frontend incorrectly parses values assigned to HTML...

PT-2024-40242 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue arises from Phar files, which can act as self-extracting archives, leading to the execution of source code when invoked. Phar files can be disguised with various file extensions,...

PT-2024-40283 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue arises from the failure to properly encode user input, making notifications shown in modal windows in the backend susceptible to cross-site scripting. A valid backend user account i...

PT-2024-40534 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue allows existing sessions for a user account to remain active even after the user changes their password. To exploit this, an attacker would need a valid user account, either...

PT-2024-40443 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: A issue has been found that allows editors with access to the file list module to list all file names and folder names in the root directory of a TYPO3 installation. However, modification of...

PT-2024-40064 · Unknown · Form Framework

Name of the Vulnerable Software and Affected Versions: Form Framework system extension "form" affected versions not specified Description: The issue arises from the failure to properly separate system-related configuration from user-generated configuration, leading to SQL injection and Privilege...

pcp: exposure of the redis server backend allows remote command execution via pmproxy

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be...

PT-2024-40172 · Unknown · Simplesamlphp

Name of the Vulnerable Software and Affected Versions: SimpleSAMLphp versions 1.16.x up to 1.16.2 Description: The issue arises from the storage of credentials obtained for authentication in the state array, which can be persisted to the user's session and stored in permanent storage. This occurs...

CVE-2024-35237 MIT IdentiBot User-Kerberos Mapping Publicly Available

MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e...

Online Student Enrollment System SQL注入漏洞

Online Student Enrollment System is an online student enrollment system by Lyndon Bermoy, an individual developer. A SQL injection vulnerability exists in Online Student Enrollment System version 1.0, which can be exploited by an attacker to view, add, modify, or delete information in the back-en...