4811 matches found
MAL-2024-1604 Malicious code in @yashorg/frontend-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff07f4f96c73a58bf8e1069d844465549fbe1c2a9dd169ef994b1124c5a143e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
TYPO3 Cross-Site Scripting in Frontend User Login
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template...
GHSA-2RCW-9HRM-8Q7Q TYPO3 Cross-Site Scripting in Frontend User Login
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template...
TYPO3 Denial of Service in Frontend Record Registration
TYPO3’s built-in record registration functionality aka basic shopping cart using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual...
GHSA-G585-CRJF-VHWQ TYPO3 Denial of Service in Frontend Record Registration
TYPO3’s built-in record registration functionality aka basic shopping cart using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual...
TYPO3 Cross-Site Scripting in Form Framework
Failing to properly encode user input, frontend forms handled by the form framework system extension “form” are vulnerable to cross-site scripting...
TYPO3 Cross-Site Scripting in Link Handling
It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink...
GHSA-XGMX-J3HV-JH9X TYPO3 Cross-Site Scripting in Link Handling
It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink...
GHSA-HH95-5XM5-V8V7 TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling
It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey as secret - invalid or unsigned payload is not deserialized. However, since sensiti...
TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling
It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey as secret - invalid or unsigned payload is not deserialized. However, since sensiti...
MAL-2024-1537 Malicious code in e2e-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2cc0de9f1d67d84da5e112a98d424fc366b573aa24bc68ac638ae8fdab9ef1f9 The OpenSSF Package Analysis project identified 'e2e-frontend' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in e2e-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2cc0de9f1d67d84da5e112a98d424fc366b573aa24bc68ac638ae8fdab9ef1f9 The OpenSSF Package Analysis project identified 'e2e-frontend' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
GHSA-QR5F-6FCV-W69Q Typo3 Security Misconfiguration in Frontend Session Handling
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...
Typo3 Security Misconfiguration in Frontend Session Handling
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...
GHSA-G9RV-6G56-65H8 Typo3 Security Misconfiguration in User Session Handling
When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...
Typo3 Security Misconfiguration in User Session Handling
When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...
GHSA-PW2Q-QWVJ-GH43 Cache Flooding in TYPO3 Frontend
Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the...
Cache Flooding in TYPO3 Frontend
Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the...
GHSA-MH3R-6CP5-HC2J Authentication Bypass in TYPO3 Frontend
Due to late TCA initialization the authentication service fails to restrict frontend user according to the validation rules. Therefore it is possible to authenticate restricted e.g. disabled frontend users...
Authentication Bypass in TYPO3 Frontend
Due to late TCA initialization the authentication service fails to restrict frontend user according to the validation rules. Therefore it is possible to authenticate restricted e.g. disabled frontend users...