CVE-2021-36791

The datednews aka Dated News extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data...

CVE-2021-36790

The CVE-2021-36790 entry affects the TYPO3 dated_news extension (up to version 5.1.1). The vulnerability is a Cross-Site Scripting (XSS) flaw caused by improper encoding of user input for HTML output, enabling injection of malicious scripts. Severity is reflected as MEDIUM (CVSS v2: 4.3; CVSS v3....

CVE-2021-36790

The datednews aka Dated News extension through 5.1.1 for TYPO3 allows XSS...

CVE-2021-36789

The datednews aka Dated News extension through 5.1.1 for TYPO3 allows SQL Injection...

CVE-2021-36789

CVE-2021-36789 corresponds to a SQL Injection vulnerability in the TYPO3 dated_news (Dated News) extension up to version 5.1.1. The issue is caused by improper handling/encoding of user input, enabling injection via database queries. Connected sources confirm the same extension is involved and re...

PT-2021-21360 · Typo3 · Dated News

Name of the Vulnerable Software and Affected Versions: dated news extension versions through 5.1.1 for TYPO3 Description: The issue concerns incorrect Access Control for confirming various applications. Recommendations: For dated news extension versions through 5.1.1, update to a version later th...

Multiple vulnerabilities in Extension "Dated News" (dated_news)

The extension fails to properly encode user input for output in HTML context CVE-2021-36790 and contains a blind SQL injection vulnerability CVE-2021-36789. It is also possible to confirm various applications CVE-2021-36792 and thereby obtain all application registration data CVE-2021-36791...