EUVD-2023-0784

Malicious code in bioql PyPI...

Cross Site Scripting (XSS)

typo3 is vulnerable to Stored XSS. The vulnerability is due to GeneralUtility::getIndpEnv function which uses unfiltered server environment variable PATHINFO and TypoScript setting config.absRefPrefix=auto. This can lead to an attacker injecting malicious content or malicious HTML code in...

TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C 8.2 Problem TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In combination with the TypoScript setting...