CVE-2015-5956: Improper Neutralization of Input During Web Page Generation

The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting XSS attacks via a base64 encoded data URI, as demonstrated by the 1 returnUrl parameter to showrechis.php and...

PT-2015-7096

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.40 and earlier TYPO3 versions 6.x through 6.2.14 TYPO3 versions 7.x through 7.3.x Description The issue allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting XSS attacks via a base64...