direct_mail for Typo3 sensitive data exposure

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping " document.getElementById"test".submit; The XSS will be...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2 <=4.6.0.0), ai.ylyue:yue-library-auth-client (=j11.2.6.0) +1751 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=5.6.0 <=5.6.3)

org.springframework.security:spring-security-core MAVEN version =5.6.0, =4.4.0.2, =1.3.1.RELEASE, =0.2.0, =0.8.3, =2.1.0.M8, =1.0.0, =2.7.0.Beta3, =2.7.0.Beta4, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.RC1 and more Source cves: CVE-2022-22978 Source advisory: OSV:GHSA-HH32-7344-CG2F...

Typo3 Open Redirect In Frontend Rendering

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that...

GHSA-V6XV-RMQC-WCC8 Typo3 Open Redirect In Frontend Rendering

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that...

com.liferay:com.liferay.adaptive.media.web (>=1.0.0 <=1.0.6), com.liferay:com.liferay.amazon.rankings.web (>=1.0.0 <=1.0.14) +128 more potentially affected by CVE-2017-12648 via com.liferay:com.liferay.frontend.taglib (>=1.0.0 <=2.1.0)

com.liferay:com.liferay.frontend.taglib MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.11 and more Source cves: CVE-2017-12648 Source advisory: OSV:GHSA-CM99-X97G-9QX8...

ForkCMS Directory Traversal vulnerability

Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to frontend/js.php...

GHSA-7WFQ-WMX2-3WR4 Withdrawn Advisory: Home Assistant Frontend XSS Vulnerability

Withdrawn Advisory This advisory has been withdrawn because we cannot confirm home-assistant-frontend is or was ever published to npm. Original Description In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS...

Withdrawn Advisory: Home Assistant Frontend XSS Vulnerability

Withdrawn Advisory This advisory has been withdrawn because we cannot confirm home-assistant-frontend is or was ever published to npm. Original Description In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS...

com.custardsource.parfait:parfait-cxf (>=0.2.0 <=0.3.9), com.redhat.rhevm.api:rhevm-api-cli-actions (>=0.9-milestone1 <=0.9-milestone-4.4) +60 more potentially affected by CVE-2010-2076 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.2.1 <=2.2.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.2.1, =0.2.0, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.1-milestone,...

org.apache.camel:camel-cxf (>=2.9.0 <=2.9.0-RC1), org.apache.camel:camel-example-cxf (>=2.9.0 <=2.9.0-RC1) +31 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.5.0 <=2.5.1)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.5.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.5.0, =2.5.0, =2.5.0, =2.5.0, =2.5.1 and more Source cves: CVE-2013-2160 Source advisory: OSV:GHSA-254Q-RP36-V2M8...

com.argusoft:medplat_core (>=0.0.1 <=0.0.11), com.argusoft:medplat_lms (=0.0.1) +63 more potentially affected by CVE-2014-3584 via org.apache.cxf:cxf-rt-frontend-jaxrs (=3.0.0)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-frontend-jaxrs and may be impacted: - com.argusoft:medplatcore =0.0.1, =0.1.0, =0.1.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0....

com.github.livesense:org.liveSense.sample.webServiceServlet (>=1.0.3 <=1.0.5), com.github.livesense:org.liveSense.service.cxf (>=1.0.3 <=1.0.5) +224 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0 <=2.7.3)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =1.0.3, =1.0.3, =1.0.0, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =2.3, =1.0.0, =1.4, =0.9, =2.9.1-SP.10, =1.1.0.Beta1, =1.1.0.Beta6 and more Source cves: CVE-2013-2160 Source advisory: OSV:GHSA-254Q-RP36-V2M8...

com.apitrary:apitrary-api-client (=0.1), com.apitrary:apitrary-orm-core (=0.1) +95 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.6.0 <=2.6.6)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.6.0, =0.0.2, =1.0.0, =1.0.0, =1.0.3, =1.0.M1, =1.0.M1, =1.0.M2, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2013-2160 Source advisory: OSV:GHSA-254Q-RP36-V2M8...

Missing Authorization

Overview in2code/femanager is a Modern TYPO3 Frontend User Registration. Affected versions of this package are vulnerable to Missing Authorization via unspecified vectors. An attacker can modify or delete the records of other frontend users by exploiting these vectors. Remediation Upgrade...

GHSA-377V-8637-6VQ6 TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

ai.platon.pulsar:pulsar-persist (>=1.9.0 <=1.10.23), com.argonio.gora:gora-accumulo (>=0.5 <=0.5.1) +148 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.1 <=2.5.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.1, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =4.0.0, =0.2.0, =1.0.2, =1.0.0, =1.0.0-beta-2 - com.meschbach.psi:salutator =2.4 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

com.github.livesense:org.liveSense.sample.webServiceServlet (>=1.0.3 <=1.0.5), com.github.livesense:org.liveSense.service.cxf (>=1.0.3 <=1.0.5) +195 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0 <=2.7.2)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =1.0.3, =1.0.3, =1.0.0, =0.4.0, =0.4.1, =2.3, =1.3.1, =1.4, =0.9, =2.9.1-SP.10, =1.1.0.Beta1, =1.1.0.Beta1, =1.1.0.Beta1, =1.1.0.Beta1, =1.2.0.Beta4 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

GHSA-RJRQ-93HP-22WW Frontend User Registration extension for TYPO3 does not properly verify access rights

Frontend User Registration srfeuserregister extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors...