Cross-Site Scripting in extension BE User Log (beko_beuserlog)

It has been discovered that the extension "BE User Log" bekobeuserlog is susceptible to Cross-Site Scripting Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.1.1 and below Vulnerability...

SQL Injection vulnerability in extension Developer Log (devlog)

It has been discovered that the extension "Developer Log" devlog is susceptible to SQL Injection Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 2.11.3 and below Vulnerability Type: SQL...

SQL Injection vulnerability in extension Store Locator (locator)

It has been discovered that the extension "Store Locator" locator is susceptible to SQL Injection Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 3.3.0 and below Vulnerability Type: SQL...

Several vulnerabilities in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to Cross-Site Scripting and Cross-Site Request Forgery. Release Date: September 26, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: versi...

Cross-Site Scripting vulnerability in extension Front End User Registration (sr_feuser_register)

It has been discovered that the extension "Front End User Registration" srfeuserregister is vulnerable to Cross-Site Scripting. Release Date: August 05, 2013 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Version: 3.0.1 and alll...

Cross-Site Scripting vulnerability in extension Basic SEO Features (seo_basics)

It has been discovered that the extension "Basic SEO Features" seobasics is vulnerable to Cross-Site Scripting Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.8.1 and below Vulnerability Type: Cross-Site Scripting...

Directory Traversal and Code Injection vulnerability in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Directory Traversal and Code Injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.11.1 and below Vulnerability Type: Directory...

TYPO3 Security Bulletin

It has been discovered that the extension mmforum mmforum is vulnerable to Information Disclosure. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.9.0 and all versions below Vulnerability Type: Information...

TYPO3 Security Bulletin

It has been discovered that the extension WEC Discussion Forum wecdiscussion is vulnerable to Cross-Site Scripting XSS and SQL injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.7.0 and all versions below...

CSRF in extension "femanager" (femanager)

The extension fails to implement a CSRF protection for edit and delete actions...

Multiple vulnerabilities in extension "phpMyAdmin" (phpmyadmin)

Multiple vulnerabilities have been found in the phpMyAdmin component...

Multiple vulnerabilities in extension "typo3_forum" (typo3_forum)

The extension fails to property check User Access Rights to posts which makes it possible for registered forum users to modify and take over posts of foreign users. The extension also creates an upload directory with 777 permissions...

Missing Access Check in extension "Register to tt_address" (registeraddress)

Due to a missing access check, it is possible to delete certain ttaddress records...

Cross-Site Scripting in form component

It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting Component Type: TYPO3 CMS Release Date: February 16, 2016 Vulnerable subcomponent: form component Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.17 Severity: Low Suggested CVSS v2.0:...

Unauthenticated Path Disclosure

It has been discovered, that TYPO3 is susceptible to unauthenticated path disclosure. Component Type: TYPO3 CMS Release Date: September 8, 2015 Vulnerable subcomponent: Frontend Vulnerability Type: Information Disclosure Affected Versions: Versions 6.2.0 to 6.2.14, 7.0.0 to 7.3.1 Severity: Low...

TYPO3 Security Bulletin

Under special circumstances, setting config.baseURL see typo3.org/documentation/document-library/doccoretsref/quotCONFIGquot/ to a numeric value "1" could be used to spoof a malicious baseURL into your TYPO3 cache. It has now been decided to technically prevent this misconfiguration. Component...

Broken Access Control in extension "gForum" (g_forum)

The extension fails to check access rights of authenticated frontend users allowing to create, edit and delete various records of the extension without proper permission...

Privilege Escalation in extension "femanager direct mail subscription" (femanager_dmail_subscribe)

Failing to properly check access rights, the extension is susceptible to privilege escalation, making it possible for a logged in frontend user to modify other frontend user records...

Information Disclosure in extension "TemplaVoilà! Plus" (templavoilaplus)

Due to a missing access check it is possible to view the contents any file within a TYPO3 installation. A valid backend user account having access to the "TemplaVoilà! Plus" backend module is needed in order to exploit this vulnerability...

SQL Injection vulnerability in extension Smoelenboek (ncgov_smoelenboek)

It has been discovered that the extension "Smoelenboek" ncgovsmoelenboek is susceptible to SQL Injection Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.0.8 and below Vulnerability Type...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Brainstorming brainstorming, Power Extension Manager chlightem, Sellector.com Widget Integration chsellector, Educator educator, MK Wastebasket mkwastebasket, myDashboard mydashboard, CleanDB nfcleandb, Diocese...

Cross Site-Scripting in extension "Caretaker" (caretaker)

Solution: An updated version 0.8.1 is available from the TYPO3 Extension Manager and at . Users of the extension are advised to update the extension as soon as possible...

Multiple vulnerabilities in extension Statistics (ke_stats)

It has been discovered that the extension Statistics kestats is vulnerable to Blind SQL Injection attacks. Also, a Cross Site Scripting issue has been found. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.1.2 and...