CVE-2014-9017

Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...

CVE-2014-9017: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...

PT-2015-4134

Name of the Vulnerable Software and Affected Versions OpenKM versions prior to 6.4.19 build 23338 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to "frontend/index.jsp". Recommendations For...

Authentication Bypass in TYPO3 CMS 4.5

It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass. Component Type: TYPO3 CMS Vulnerability Types: Authentication Bypass Overall Severity: Critical Release Date: February 19, 2015 Bulletin Update: February 23, 2015 added CVE Vulnerable subcomponent: rsaauth system...

Important Security-Bulletin Pre-Announcement

A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. The TYPO3 security team has identified a critical security issue in the TYPO3 v4 Core. The following branches are affected by the vulnerability: TYPO3 4.3...

Cross site scripting

Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-100034

Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-100034: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-3642

Name of the Vulnerable Software and Affected Versions LicensePal ArcticDesk versions prior to 1.2.5 Description A cross-site scripting XSS issue exists in the frontend interface, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 1.2.5, update ...

CVE-2014-9508

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...

Code injection

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...

CVE-2014-9509

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact possibly resource consumption via a "Cache Poisoning" attack using a...

CVE-2014-9508

TYPO3 Open Redirect/Link Spoofing vulnerability CVE-2014-9508 affects the frontend rendering component. Affected: TYPO3 4.5.x before 4.5.39, 4.6.x–6.2.x before 6.2.9, and 7.x before 7.0.2. Condition: config.prefixLocalAnchors enabled with an anchor-only homepage; attacker can modify anchor-only l...

CVE-2014-9508

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...

CVE-2014-9509

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact possibly resource consumption via a "Cache Poisoning" attack using a...

CVE-2014-9509

CVE-2014-9509 affects TYPO3: the frontend rendering component in TYPO3 4.5.x (before 4.5.39), 4.6.x–6.2.x (before 6.2.9), and 7.x (before 7.0.2). When config.prefixLocalAnchors is set to all or cached, remote attackers can trigger a cache-poisoning scenario by crafting a URL with arbitrary argume...

CVE-2014-9508

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...

CVE-2014-9509: Improper Input Validation

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact possibly resource consumption via a "Cache Poisoning" attack using a...

PT-2015-4253

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.x through 4.5.38 TYPO3 versions 4.6.x through 6.2.x before 6.2.9 TYPO3 versions 7.x before 7.0.2 Description The frontend rendering component in TYPO3 allows remote attackers to change URLs to arbitrary domains for links tha...

CVE-2014-9508: Improper Link Resolution Before File Access

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via...