CVE-2021-21355

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default...

CVE-2021-21340

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to explo...

CVE-2021-21340

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to explo...

CVE-2021-21370

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid...

Code injection

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to ...

Cross site scripting

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid...

CVE-2021-21359 Denial of Service in Page Error Handling

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to ...

CVE-2021-21359

TYPO3 core vulnerability CVE-2021-21359 affects TYPO3 CMS before 9.5.25, 10.4.14, and 11.1.1. When a user requests invalid or non-existing resources via HTTP, the page error handler could retrieve content to display from another page, causing the application to call itself recursively and potenti...

CVE-2021-21370

TYPO3 core contains a cross-site scripting (XSS) vulnerability in content elements of type menu when their referenced items are previewed in the page module. A valid backend user account is required to exploit. Affected versions are TYPO3 before 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1; remedi...

CVE-2021-21339

CVE-2021-21339 affects TYPO3, a PHP-based CMS. The issue is that user session identifiers were stored in cleartext in versions prior to 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1. The root cause is storage of session identifiers without additional cryptographic hashing, and exploitation ...

CVE-2021-21339 Cleartext storage of session identifier

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited...

CVE-2021-21340

TYPO3 core vulnerability CVE-2021-21340: In TYPO3 versions earlier than 10.4.14 and 11.1.1, database fields used as descriptionColumn could be exploited for cross-site scripting when content is previewed. A valid backend user is required to exploit. The issue is fixed in TYPO3 10.4.14 and 11.1.1....

CVE-2021-21355

TYPO3 8.7.40, 9.5.25, 10.4.14, 11.1.1 fix a file-upload vulnerability where UploadedFileReferenceConverter can accept any mime-type for certain Extbase-based uploads, allowing attackers to place arbitrary files under /fileadmin/user_upload/ (and potentially reference/guess filenames). Impact stat...

CVE-2021-21357

TYPO3 Form Framework vulnerability (CVE-2021-21357): Improper input validation in Form Designer enables bypass of predefined option restrictions, allowing upload of arbitrary MIME types and persistence of files in writable TYPO3 directories. Requires a valid backend user to exploit. Affects TYPO3...

CVE-2021-21358

TYPO3 CMS is affected by a cross-site scripting (XSS) vulnerability in the Form Designer backend module of the Form Framework. The issue exists in TYPO3 versions before 10.4.14 and 11.1.1, and requires a valid backend user account with access to the Form module to exploit. It is fixed in versions...

DynPG 安全漏洞

DynPG is a free open source software for managing web content and modules while focusing on business process automation. A cross-site scripting vulnerability exists in DynPG 4.9.2. A remote attacker can exploit this vulnerability by injecting JavaScript via the "page" parameter...

Dynpg组织 Dynpg 跨站脚本漏洞

DynPG is a free open source software for managing web content and modules while focusing on business process automation. A cross-site scripting vulnerability exists in DynPG 4.9.2. A remote attacker can exploit this vulnerability by injecting JavaScript via the "query" parameter...

macOS 11.x < 11.2.3 (HT212220)

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.2.3 Big Sur. It is, therefore, affected by a memory corruption issue due to insufficient validation. An attacker can exploit this with crafted web content to cause arbitrary code execution. Note that Nessus has not...

Deserialization vulnerability in kitecms

KiteCMS is an open source web content management system CMS, the system is based on the framework ThinkPHP5.1. version of the development of the system, for individuals and enterprises to quickly build a station and development needs. Kitecms has a deserialization vulnerability that can be...

Apple Issues Patch for Remote Hacking Bug Affecting Billions of its Devices

Apple has released out-of-band patches for iOS, macOS, watchOS, and Safari web browser to address a security flaw that could allow attackers to run arbitrary code on devices via malicious web content. Tracked as CVE-2021-1844, the vulnerability was discovered and reported to the company by Clémen...