473 matches found
Important Security-Bulletin Pre-Announcement
TYPO3 releases containing a fix for a critical vulnerability will be published Tuesday 24th of May at about 10:00 a.m. CEST 08:00 a.m. GMT. UPDATE Add clarification regarding TYPO3 4.5 The TYPO3 security team has identified a critical security issue in the TYPO3 CMS Core. All TYPO3 versions from...
Critical vulnerabilities in ImageMagick
Multiple vulnerabilities in ImageMagick have been discovered, Remote Code Execution being one of them. For image manipulation TYPO3 CMS makes use of either one of the third party tools GraphicsMagick or ImageMagick. Recently it has been discovered, that ImageMagick exposes multiple vulnerabilitie...
Cross-Site Scripting in legacy form component
It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting Component Type: TYPO3 CMS Release Date: February 16, 2016 Vulnerable subcomponent: legacy form component Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.17 Severity: Low Suggested CVSS v2.0...
Cross-Site Scripting in link validator component
It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting Component Type: TYPO3 CMS Release Date: February 16, 2016 Vulnerable subcomponent: link validator Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.17 and 7.6.0 to 7.6.2 Severity: Low Suggest...
SQL Injection in extension "Akronymmanager" (sb_akronymmanager)
It has been discovered that the extension "Akronymmanager" sbakronymmanager is susceptible to SQL Injection Release Date: June 18, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 0.5.0 and below Vulnerability...
Important Security-Bulletin Pre-Announcement
A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. The TYPO3 security team has identified a critical security issue in the TYPO3 v4 Core. The following branches are affected by the vulnerability: TYPO3 4.3...
Several vulnerabilities in extension phpMyAdmin (phpmyadmin)
It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to Cross-Site Scripting and Cross-Site Request Forgery. Release Date: September 26, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: versi...
Several Vulnerabilities in extension commerce (commerce)
It has been discovered that the extension commerce commerce is vulnerable to Cross Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.12.7 and below Vulnerability Types: Cross Site Scripting Severity:...
Cross-Site Scripting vulnerability in extension powermail for TYPO3 (powermail)
It has been discovered that the extension "powermail" powermail is vulnerable to Cross-Site Scripting Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.6.4 and below Vulnerability Types: Cross-Site Scripting Severit...
Several Vulnerabilities in extension Direct Mail Subscription (direct_mail_subscription)
Several vulnerabilities have been found in the following third-party TYPO3 extension: directmailsubscription Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.1.0 and below Vulnerability Types: SQL Injection,...
Multiple SQL Injection vulnerabilities in extension "Website Photo Gallery" (jm_gallery)
It has been discovered that the extension Website Photo Gallery jmgallery is vulnerable to SQL injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.9.1 and below Vulnerability Type: SQL Injection Severity:...
Blind SQL Injection vulnerability in extension Calendar Base (cal)
It has been discovered that the extension Calendar Base cal is vulnerable to Blind SQL Injection. Release Date: March 2, 2010 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.3.1 and all versions below Vulnerabilit...
Blind SQL Injection vulnerability in extension Calendar Base (cal)
It has been discovered that the extension Calendar Base cal is vulnerable to Blind SQL Injection. Release Date: December 1, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.2.0 and all versions below...
TYPO3 Security Bulletin
Several vulnerabilities have been found in TYPO3 third party extensions. Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with neither significant download numbers, nor other special importance amongst the TYPO3 Community. The intention of CSBs is to...
TYPO3 Security Bulletin
It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Code Execution. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 3.2.0 and all versions below Vulnerability Type: Code execution...
Privilege Escalation in extension "femanager direct mail subscription" (femanager_dmail_subscribe)
Failing to properly check access rights, the extension is susceptible to privilege escalation, making it possible for a logged in frontend user to modify other frontend user records...
Multiple vulnerabilities in extension "phpMyAdmin" (phpmyadmin)
Multiple vulnerabilities have been found in the phpMyAdmin component...
Denial of Service in Online Media Asset Handling
Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...
Information Disclosure in Install Tool
The Install Tool exposes the current TYPO3 version number to non-authenticated users...
Cross-Site Scripting in Backend Modal Component
Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...
TYPO3 is susceptible to Cross-Site Flashing
It has been discovered, that TYPO3 is susceptible to Cross-Site Flashing Component Type: TYPO3 CMS Release Date: December 15, 2015 Vulnerable subcomponent: Flvplayer Vulnerability Type: Affected Versions: Versions 6.2.0 to 6.2.15 Severity: Medium Suggested CVSS v2.0:...
Access bypass when editing file metadata
It has been discovered, that editors could change, create or delete metadata of files without permission. Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Broken Access Control Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0...
Cross-Site Scripting exploitable by Editors
It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low Suggested CVSS v2.0:...
Cross-Site Scripting in extension BE User Log (beko_beuserlog)
It has been discovered that the extension "BE User Log" bekobeuserlog is susceptible to Cross-Site Scripting Release Date: June 15, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.1.1 and below Vulnerability...
Information Disclosure in Direct Mail Subscription (direct_mail_subscription)
It has been discovered that the extension "Direct Mail Subscription" directmailsubscription is susceptible to Information Disclosure. Release Date: January 16, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 2.0.1...
Cross-Site scripting vulnerability in extension t3blog (t3blog)
It has been discovered that the extension "T3Blog" t3blog is vulnerable to Cross-Site Scripting. Release Date: September 27, 2011 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.1.1 and all versions below...
Multiple XSS vulnerabilities in extension phpMyAdmin (phpmyadmin)
It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.11.3 and below Vulnerability Type: Multiple Cross-Site Scripti...
Multiple vulnerabilities in TYPO3 Core
It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting XSS, Open Redirection, SQL Injection, Broken Authentication and Session Management, Insecure Randomness, Information Disclosure, Arbitrary Code Execution Component Type: TYPO3 Core Affected Versions: 4.1.13 and below,...
Vulnerability in TYPO3 Core
It has been discovered that TYPO3 Core is vulnerable to Remote Command Execution. Component Type: TYPO3 Core Affected Versions: 4.3.0, 4.3.1 and 4.3.2 + development releases of 4.4 branch Vulnerability Types: Remote Command Execution Overall Severity: Critical Release Date: April 9, 2010 Vulnerab...
Multiple vulnerabilities in third party extensions
Several vulnerabilities have been found in the following third party TYPO3 extensions: "CoolURI" cooluri, "Reset backend password" cwtresetbepassword, "datamints Newsticker" datamintsnewsticker, "Gobernalia Front End News Submitter" gbfenewssubmit, "Mailform" mailform, "Myth download" mythdownloa...
Information Disclosure in third party extension "Frontend User registration"
It has been discovered that the TYPO3 extension "Frontend User Registration" srfeuserregister is susceptible to Information Disclosure. Release Date: April 6, 2009 Component Type: Third party extension. This extension is not a part of a TYPO3 default installation. Affected Versions: 2.5.20 and al...
Cross-Site Scripting vulnerability in TYPO3 Core
It has been discovered that the backend module "file" is vulnerable to Cross-Site Scripting XSS. Component Type: TYPO3 Core Affected Version: TYPO3 version 4.2.2 Vulnerability Type: Cross Site Scripting Vulnerability: Backend module "file" is susceptible to Cross-Site Scripting. Severity: Low...
Multiple vulnerabilities in extension WEC Discussion Forum (wec_discussion)
It has been discovered that the extension WEC Discussion Forum wecdiscussion is open to multiple security issues. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.6.2 and all versions below Vulnerability Type:...
Information disclosure in w4x_backup
It has been discovered that the extension w4xbackup has several security related issues, which may disclosure confidential information. Component Type: Third party extension. This extension is not part of the TYPO3 default installation Affected Versions: Version 0.9.1 and all versions below...
tip-a-friend
A problem has been discovered with tip-a-friend being vulnerable to Cross-Site-Scripting XSS Component Type: Third Party Extension. The extension is not part of the TYPO3 default installation Affected Components: tipafriend Versions: 1.2.1 and earlier Vulnerability Type: Cross Site Scripting...
chc_forum
A bug has been discovered in the "CHC Forum" chcforum extension where some Javascript expressions are not properly caught when entered in forms. Thus, specially crafted entries may be used to inject malicious code. Component Type: Third Party Extension. This extension is third party code that has...
TYPO3 Security Bulletin
An issue has been reported where a bug in the "cmwlinklist" extension allows SQL injection attacks. In specific situations, a remote offender can cause malicious database operations. Component Type: Third Party Extension. This extension is third party code that has not been submitted to the TYPO3...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfigincludes is vulnerable to directory traversal leading to same scenarios as...
Multiple vulnerabilities in extension "Fe user statistic" (festat)
It has been discovered that the extension "Fe user statistic" festat is susceptible to Cross-Site Scripting, Insecure Unserialize and Information Disclosure. Release Date: March 03, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affecte...
Several vulnerabilities in third party extensions
Several vulnerabilities have been found in the following third-party TYPO3 extensions: accessibleisbrowseresults, maagformcaptcha, metafeedit, rzautocomplete, sbfolderdownload, sgzfelib, sgzlib, tqseo Release Date: June 03, 2013 Please read first: This Collective Security Bulletin CSB is a listin...
Several Vulnerabilities in extension Formhandler (formhandler)
It has been discovered that the extension Formhandler formhandler is vulnerable to SQL-Injection and Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.4.0 and below Vulnerability Types: SQL...
Cross-site scripting vulnerability in extension Seminars (seminars)
It has been discovered that the extension "Seminars" seminars is vulnerable to cross-site scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.9.3 and below Vulnerability Type: Cross-site scripting Severity:...
Vulnerabilitiy in extension Frontend User Registration (sr_feuser_register)
It has been discovered that the extension Frontend User Registration srfeuserregister is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extensions is not part of the TYPO3 default installation. Affected Versions: Version 2.5.24 and all versions below...
Blind SQL Injection vulnerability in extension T3M E-Mail Marketing Tool (t3m)
It has been discovered that the extension T3M E-Mail Marketing Tool t3m is vulnerable to Blind SQL Injection attacks. Release Date: August 18, 2009 Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.2.4 and below...
TYPO3 Security Bulletin
Several vulnerabilities have been found in the following third party TYPO3 extensions: "Vox populi" mvvoxpopuli, "SB Universal Plugin" SBuniplug, "Simple File Browser" simplefilebrowser, "TU-Clausthal ODIN" tucodin, "TU-Clausthal Staff" tucstaff, "WEBERkommunal Facilities" wesfacilities Please re...
Cross Site Scripting vulnerability in faq
It has been discovered that the extension faq is susceptible to cross site scripting XSS attacks, making it possible to execute arbitrary JavaScript. Component Type: Third party extension. This extension is not part of the TYPO3 default installation Affected Versions: Version 0.0.7 and all versio...
Remote Command Execution
A critical problem has been discovered in plugin class.txrtehtmlareapi1.php that is used for spell-checking in the rtehtmlarea extension. Component Type: System Extension TYPO3 Versions 4.0-4.0.3, 4.1beta Third Party Extension TYPO3 Versions up to 3.8.1. Since TYPO3 Version 4.0 the extension is...
Information Disclosure in User Authentication
It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials...
Multiple vulnerabilities in extension "typo3_forum" (typo3_forum)
The extension fails to property check User Access Rights to posts which makes it possible for registered forum users to modify and take over posts of foreign users. The extension also creates an upload directory with 777 permissions...