473 matches found
SQL Injection vulnerability in extension Basic SEO Features (seo_basics)
It has been discovered that the extension "Basic SEO Features" seobasics is vulnerable to SQL Injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.8.2 and below Vulnerability Type: SQL Injection Severity: Hi...
Multiple vulnerabilities in TYPO3 Core
It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting XSS, Information Disclosure, Authentication Delay Bypass, Unserialize vulnerability, Missing Access Control. Component Type: TYPO3 Core Affected Versions: 4.3.11 and below, 4.4.8 and below, 4.5.3 and below Vulnerability...
TYPO3 Security Bulletin
It has been discovered that the extension Virtual Civil Services civserv is vulnerable to SQL-injections. Release Date: June 16, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.3.2 and all versions below...
Cross-Site Scripting vulnerability in TYPO3 Core
It has been discovered that the frontend plugin of system extension "felogin" is vulnerable to Cross-Site Scripting XSS. Component Type: TYPO3 Core Affected Versions: TYPO3 versions 4.2.0, 4.2.1 and 4.2.2 Vulnerability Type: Cross Site Scripting Vulnerability: The frontend plugin of system...
TYPO3 Security Bulletin
It has been discovered that the extension freeCap CAPTCHA srfreecap is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.0.3 and all versions below Vulnerability Type: Cross-Site...
Cross Site Scripting vulnerability in extension "KJ: Image Lightbox v2" (kj_imagelightbox2)
It has been discovered that the extension "KJ: Image Lightbox v2" kjimagelightbox2 is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.4.2 and below, possibly also all...
SQL Injection in extension "Library for Frontend plugins" (sg_zfelib)
It has been discovered that the extension "Library for Frontend plugins" sgzfelib is susceptible to SQL Injections. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.1.512 and below Vulnerability Type: SQL Injection...
Multiple vulnerabilities in extension MailformPlus (th_mailformplus)
It has been discovered that the extension MailformPlus thmailformplus is susceptible to Cross Site Scripting XSS attacks and allows Remote Code Execution. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 4.0.3 and belo...
Multiple vulnerabilities in extension ve_guestbook
It has been discovered that the extension veguestbook is vulnerable to SQL Injection attacks. Also, a Cross Site Scripting issue has been detected. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.9.3 and below...
Multiple vulnerabilities in civserv
Multiple vulnerabilities has been found in the extension civserv: Incorrect handling of input from GET/POST-variables, and allowing an attacker to execute XSS and/or SQL Injection attacks. Component Type: Third party extension. This extension is not part of the TYPO3 default installation Affected...
TYPO3 Security Bulletin
A weakness in the display of forum messages of chcforum has been discovered that may be used to execute arbitrary SQL Component Type: Third Party Extension. The extension is not part of the TYPO3 default installation Affected Components: chcforum Versions: 1.4.4 and earlier Vulnerability Type: SQ...
TYPO3 Security Bulletin
The file editor functionality in the TYPO3 Install Tool menu option "Edit files in typo3conf/" has an option that reads "Make backup copy". If set, this will create a backup copy and append a "" to the original file name. This leads to file names that may be delivered as text files by a web serve...
TYPO3 Security Bulletin
In the past, a "Shift Reload" from the browser AKA a GET request with the "no-cache" pragma set cleared the TYPO3 cache of the requested page. This may be considered a potential target for Denial of Service attacks. Component Type: Core Affected Components: TYPO3 Page Cache Versions: TYPO3 3.8.0...
TYPO3 Security Bulletin
A debug script exposes system information provided by phpinfo. By default, the script can be executed by a remote user. Component Type: Core Affected Component: Debug Script Version: 3.8.0 and earlier Vulnerability Type: Information Disclosure Severity: Low Problem Description: A debug script...
CSRF in extension "Change password for frontend users" (fe_change_pwd)
The extension fails to implement a CSRF protection for update password action...
Cross-Site Scripting Vulnerabilities in File Upload Handling
TYPO3 allows to upload files either in the backend user interface as well as in custom developed extensions. To reduce the possibility to upload potential malicious code TYPO3 uses the fileDenyPattern to deny e.g. user submitted PHP scripts from being persisted. Besides that it is possible for an...
Cross-Site Scripting in Form Framework validation handling
It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting...
SQL Injection in extension "Event Calender" (pits_wd_calender)
The extension fails to properly sanitize user input and is susceptible to SQL Injection...
Multiple vulnerabilities in extension "phpMyAdmin" (phpmyadmin)
Multiple vulnerabilities have been found in the phpMyAdmin component...
Cross-Site Scripting in Online Media Asset Rendering
Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...
Security Misconfiguration in Install Tool Cookie
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...
Denial of Service in Frontend Record Registration
TYPO3’s built-in record registration functionality aka “basic shopping cart” using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual...
SQL Injection in extension "http:BL Blocking" (mh_httpbl)
It has been discovered that the extension "http:BL Blocking" mhhttpbl is susceptible to SQL Injection. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.1.7 and below Vulnerability...
Arbitrary Code Execution in extension "MK Forms" (mkforms)
It has been discovered that the extension "MK Forms" mkforms is susceptible to Arbitrary Code Execution Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.0.23 and below Vulnerability...
Cross-Site Scripting vulnerability in wfGallery (wf_gallery)
It has been discovered that the extension "wfGallery" wfgallery is susceptible to Cross-Site Scripting. Release Date: December 15, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 1.0.3 and all versions below...
Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin)
It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Local file inclusion. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.11.8 and below Vulnerability Type: Local file inclusion...
Cross-Site Scripting vulnerability in extension "Media [DAM]" (dam)
It has been discovered that the extension Media DAM dam is vulnerable to Cross-Site Scripting. Release Date: January 26, 2011 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.1.7 and all versions below Vulnerabilit...
TYPO3 Security Bulletin
It has been discovered that the extension powermail powermail is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.5.4 and below Vulnerability Type: Cross-Site Scripting Severity:...
Cross-Site Scripting vulnerability in extension Modern Guestbook / Commenting System (ve_guestbook)
It has been discovered that the extension Modern Guestbook / Commenting system veguestbook is vulnerable to Cross-Site Scripting. Release Date: June 16, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.7.1 and...
TYPO3 Security Bulletin
Several vulnerabilities have been found in the following third party TYPO3 extensions: JobControl dmmjobcontrol, Econda Plugin econda, Frontend Users View feusersview, Mannschaftsliste kiddogplayerlist, M1 Intern m1intern, Simple survey simplesurvey, Page Improvements smpageimprovements Please re...
Multiple vulnerabilities in TYPO3 Core
It has been discovered that the default value of the TYPO3 configuration variable fileDenyPattern allows arbitrary code execution on Apache web servers. Besides that, the library feadminlib.inc allows Cross Site Scripting XSS. Component Type: TYPO3 Core Affected Versions: TYPO3 versions 3.x, 4.0 ...
TYPO3 Security Bulletin
Two problems path traversal and SQL injection have been discovered in the extension damdownloads Component Type: Third Party Extension. The extension is not part of the TYPO3 default installation Affected Components: damdownloads Versions: 1.0.1 and earlier Vulnerability Type: Path traversal and...
Sensitive Data Exposure in extension "Job Fair" (jobfair)
The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files e.g uploads/txjobfair/cv.pdf...
Cross-Site Scripting in Link Handling
It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink...
Security Misconfiguration in Frontend Session Handling
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...
SQL Injection in extension "Faceted Search" (ke_search)
The extension fails to properly sanitize user input and is susceptible to SQL Injection...
Security Misconfiguration for Backend User Accounts
When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in orde...
Cross-Site Scripting in extension "Frontend Treeview" (mh_treeview)
The extension fails to properly encode user input for output in HTML context...
Important Security-Bulletin Pre-Announcement
TYPO3 releases containing a fix for a critical vulnerability will be published Tuesday 24th of May at about 10:00 a.m. CEST 08:00 a.m. GMT. UPDATE Add clarification regarding TYPO3 4.5 The TYPO3 security team has identified a critical security issue in the TYPO3 CMS Core. All TYPO3 versions from...
SQL Injection vulnerability in extension FAQ - Frequently Asked Questions (js_faq)
It has been discovered that the extension "FAQ - Frequently Asked Questions" jsfaq is susceptible to SQL Injection Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.2.0 and below...
Several vulnerabilities in extension phpMyAdmin (phpmyadmin)
It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to Cross-Site Scripting and Cross-Site Request Forgery. Release Date: September 26, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: versi...
Cross-Site Scripting vulnerability in extension powermail for TYPO3 (powermail)
It has been discovered that the extension "powermail" powermail is vulnerable to Cross-Site Scripting Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.6.4 and below Vulnerability Types: Cross-Site Scripting Severit...
Cross-Site scripting vulnerability in extension t3blog (t3blog)
It has been discovered that the extension "T3Blog" t3blog is vulnerable to Cross-Site Scripting. Release Date: September 27, 2011 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.1.1 and all versions below...
Cross Site Scripting Vulnerability in extension Questionaire (pbsurvey)
It has been discovered that the extension "Questionaire" pbsurvey is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.3.0 and below Vulnerability Types: Cross-Site Scripting...
SQL Injection vulnerability in extension Faceted Search (ke_search)
It has been discovered that the extension Faceted Search kesearch is vulnerable to SQL Injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.3.0 and all versions below Vulnerability Type: SQL Injection...
Cross-Site Scripting vulnerability in extension mm_forum (mm_forum)
It has been discovered that the extension mmforum mmforum is vulnerable to Cross-Site Scripting. Release Date: March 16, 2010 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.8.2 and all versions below Vulnerabilit...
Multiple vulnerabilities in third party extensions
Several vulnerabilities have been found in the following third party TYPO3 extensions: MK-AnydropdownMenu mkanydropdownmenu, Photo Book gooffotoboek, SB Folderdownload sbfolderdownload, Developer log devlog, KJ: Imagelightbox kjimagelightbox2, Unit Converter cs2unitconv, powermail powermail, TV21...
Multiple vulnerabilities in third party extensions
Several vulnerabilities have been found in the following third party TYPO3 extensions: "FrontEnd MP3 Player" femp3player, "Search In Tables" fesearchintable, "Content Search" gstcontentsearch, "Multilingual Alias" multilingualalias, "Myth Repository" mythrepository and "References database"...
Remote shell command execution in extensions embedding PHPMailer
Multiple TYPO3 extensions is affected by the third party tool PHPMailer, which is vulnerable to a remote shell command execution. Component Type: Third party tool. This tool is not part of the TYPO3 default installation. Affected extensions: agprjmgm version 0.0.1 bbphpmailer version 1.73.1 and a...
Cross-Site Scripting vulnerability in Indexed Search
A problem has been discovered with indexed search being vulnerable to Cross-Site-Scripting XSS Component Type: System Extension This Extension is Part of the TYPO3 default installation Affected Components: Indexed Search Versions: 2.9.0 under TYPO3 4.x Vulnerability Type: Cross Site Scripting...