Cross Site Scripting Vulnerability in extension Questionaire (pbsurvey)

It has been discovered that the extension "Questionaire" pbsurvey is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.3.0 and below Vulnerability Types: Cross-Site Scripting...

Multiple SQL Injection vulnerabilities in extension "Website Photo Gallery" (jm_gallery)

It has been discovered that the extension Website Photo Gallery jmgallery is vulnerable to SQL injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.9.1 and below Vulnerability Type: SQL Injection Severity:...

Multiple vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting XSS, Information Disclosure, Authentication Delay Bypass, Unserialize vulnerability, Missing Access Control. Component Type: TYPO3 Core Affected Versions: 4.3.11 and below, 4.4.8 and below, 4.5.3 and below Vulnerability...

Several vulnerabilities in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Cross-Site Scripting, Local File Inclusion, Code Execution and Session Manipulation. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version...

Directory Traversal and Code Injection vulnerability in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Directory Traversal and Code Injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.11.1 and below Vulnerability Type: Directory...

SQL Injection vulnerability in extension Faceted Search (ke_search)

It has been discovered that the extension Faceted Search kesearch is vulnerable to SQL Injection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.3.0 and all versions below Vulnerability Type: SQL Injection...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: Photogallery cegallery, SEO Photogallery by Evorion evgallery Release Date: June 14, 2011 Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with neither significant...

Cross-Site Scripting and Open Redirection vulnerability in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Cross-Site Scripting and Open Redirection. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.10.3 and below Vulnerability Type:...

Blind SQL Injection vulnerability in extension "powermail" (powermail)

It has been discovered that the extension powermail powermail is vulnerable to Blind SQL Injection. Release Date: May 11, 2011 Version 1 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.6.0, 1.6.1 and 1.6.2...

SQL Injection vulnerabilities in extension "WEC Discussion Forum" (wec_discussion)

It has been discovered that the extension WEC Discussion Forum wecdiscussion is vulnerable to SQL Injection. Release Date: April 7, 2011 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.1.0 and all versions below...

XSS and SQL Injection vulnerabilities in extension "Direct Mail" (direct_mail)

TYPO3-SA-2011-002 Release Date: March 15, 2011 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.6.9 and all versions below Vulnerability Type: Cross-Site Scripting XSS, SQL Injection Severity: Low Suggested CVSS...

Cross-Site Scripting vulnerability in extension "Media [DAM]" (dam)

It has been discovered that the extension Media DAM dam is vulnerable to Cross-Site Scripting. Release Date: January 26, 2011 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.1.7 and all versions below Vulnerabilit...

Multiple vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Arbitrary Code Execution, Path Traversal, Cross-Site Scripting XSS, SQL injection and Information Disclosure. Component Type: TYPO3 Core Affected Versions: 4.2.15 and below, 4.3.8 and below, 4.4.4 and below Vulnerability Types: Arbitrary Cod...

TYPO3 Security Bulletin

It has been discovered that the extension powermail powermail is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.5.4 and below Vulnerability Type: Cross-Site Scripting Severity:...

Multiple vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Remote File Disclosure, Cross-Site Scripting XSS, Privilege Escalation and Denial of Service. Component Type: TYPO3 Core Affected Versions: 4.2.14 and below, 4.3.6 and below, 4.4.3 and below Vulnerability Types: Remote File Disclosure,...

TYPO3 Security Bulletin

It has been discovered that the extension powermail powermail is vulnerable to Cross-Site Scripting, SQL Injection and Validation Bypass Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.5.3 and below Vulnerability...

Multiple vulnerabilities in third-party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Commenting system Backend Module commentsbe, Tiny Market hmtinymarket, Yet Another Calendar keyac, The official twitter tweet button for your page tweetbutton, XING Button xing Release Date: September 2, 2010...

TYPO3 Security Bulletin

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.8.1 and below Vulnerability Type: Cross-Site Scripting Severit...

TYPO3 Security Bulletin

It has been discovered that the extension mmforum mmforum is vulnerable to Information Disclosure. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.9.0 and all versions below Vulnerability Type: Information...

Multiple vulnerabilities in third-party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Event event, Fe user statistic festat, JW Calendar jwcalendar, Questionnaire kequestionnaire, Branchenbuch Yellow Pages mhbranchenbuch, Webkit PDFs webkitpdf, xaJax Shoutbox vxxajaxshoutbox Release Date: August...

TYPO3 Security Bulletin

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Broken Access Control. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.1.0 till 4.8.0 including Vulnerability Type: Broken Access...

Multiple vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting XSS, Open Redirection, SQL Injection, Broken Authentication and Session Management, Insecure Randomness, Information Disclosure, Arbitrary Code Execution Component Type: TYPO3 Core Affected Versions: 4.1.13 and below,...

Vulnerabilitiy in extension Front End User Registration (sr_feuser_register)

It has been discovered that the extension Frontend User Registration srfeuserregister is susceptible to Security Misconfiguration. Component Type: Third party extension. This extensions is not part of the TYPO3 default installation. Affected Versions: Version 2.5.25. Vulnerability Type: Security...

Vulnerabilitiy in extension 404 Error Page Handling (error_404_handling)

It has been discovered that the extension 404 Error Page Handling error404handling is susceptible to SQL Injection attacks. Component Type: Third party extension. This extensions is not part of the TYPO3 default installation. Affected Versions: 0.1.1 and all versions below Vulnerability Type: SQL...

Vulnerabilitiy in extension Tip-A-Friend (tipafriend)

It has been discovered that the extension Tip-A-Friend tipafriend is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extensions is not part of the TYPO3 default installation. Affected Versions: 1.2.3 Vulnerability Type: Cross Site Scripting Severity:...

Vulnerabilitiy in extension Frontend User Registration (sr_feuser_register)

It has been discovered that the extension Frontend User Registration srfeuserregister is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extensions is not part of the TYPO3 default installation. Affected Versions: Version 2.5.24 and all versions below...

Vulnerability in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Remote Command Execution. Component Type: TYPO3 Core Affected Versions: 4.3.0, 4.3.1 and 4.3.2 + development releases of 4.4 branch Vulnerability Types: Remote Command Execution Overall Severity: Critical Release Date: April 9, 2010 Vulnerab...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Brainstorming brainstorming, Power Extension Manager chlightem, Sellector.com Widget Integration chsellector, Educator educator, MK Wastebasket mkwastebasket, myDashboard mydashboard, CleanDB nfcleandb, Diocese...

Cross-Site Scripting vulnerability in extension mm_forum (mm_forum)

It has been discovered that the extension mmforum mmforum is vulnerable to Cross-Site Scripting. Release Date: March 16, 2010 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.8.2 and all versions below Vulnerabilit...

Blind SQL Injection vulnerability in extension Calendar Base (cal)

It has been discovered that the extension Calendar Base cal is vulnerable to Blind SQL Injection. Release Date: March 2, 2010 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.3.1 and all versions below Vulnerabilit...

Vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, Authentication Bypass for frontend users and Information Disclosure. Component Type: TYPO3 Core Affected Versions: 4.2.11 and below, 4.3.1 and below Vulnerability Types: Authentication Bypass, Cross-Site Scripting XSS,...

Multiple vulnerabilities in extension T3BLOG (t3blog)

It has been discovered that the extension T3BLOG t3blog is vulnerable to SQL Injection and Cross–Site Scripting. Release Date: February 1, 2010 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.6.2 and all version...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Event Manager eventmanagement, Game Article DB gamearticledb, Simple career mlcareer, Surprise Calendar mlsurprisecalendar, Search Api Ajax Google searchajaxgoogle, Download Manager sprdownloadmanager Release...

Vulnerability in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to authentication bypass. Component Type: TYPO3 Core Affected Versions: TYPO3 version 4.3.0 with enabled system extension "openid" Vulnerability Types: Authentication Bypass Overall Severity: High Release Date: January 14, 2010 Vulnerable...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: MK-AnydropdownMenu mkanydropdownmenu, Photo Book gooffotoboek, SB Folderdownload sbfolderdownload, Developer log devlog, KJ: Imagelightbox kjimagelightbox2, Unit Converter cs2unitconv, powermail powermail, TV21...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Car car, TYPO3 Watchdog abawatchdog, File list drblob, ListMan nllistman, XDS Staff List xdsstaff, Document Directorys danpdocumentdirs, Random Prayer Version 2 steprayer2, Diocese of Portsmouth Resources...

Cross-Site Scripting vulnerability in extension Direct Mail (direct_mail)

It has been discovered that the extension Direct Mail directmail is vulnerable to XSS. Release Date: December 1, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.6.4 and all versions below Vulnerability Type:...

Blind SQL Injection vulnerability in extension Calendar Base (cal)

It has been discovered that the extension Calendar Base cal is vulnerable to Blind SQL Injection. Release Date: December 1, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.2.0 and all versions below...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: AN Search it! ansearchit, Simple download-system with counter and categories kkdownloader, Automatic Base Tags for RealUrl ltbasetag, Trips mchtrips, simple Glossar simpleglossar, TW Productfinder...

Multiple vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, SQL-Injection, Remote Command Execution, Information Disclosure and insecure Install Tool authentication/session handling. Component Type: TYPO3 Core Affected Versions: TYPO3 versions 4.0.13 and below, 4.1.12 and below,...

TYPO3 Security Bulletin

Several vulnerabilities have been found in the following third party TYPO3 extensions: Apache Solr Search solr, Random Images maagrandomimage, Flagbit Filebase fbfilebase, freeCap CAPTCHA srfreecap Release Date: Oktober 20, 2009 Please read first: This Collective Security Bulletin CSB is a listin...

Cross-Site Scripting vulnerability in extension Commerce (commerce)

It has been discovered that the extension Commerce commerce is vulnerable to Cross-Site Scripting attacks. Release Date: August 18, 2009 Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.9.8 and below. Vulnerability...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: "AIRware Lexicon" airlexicon, "AST ZipCodeSearch" astaddresszipsearch, "Car" car, "Event Registration" eventregistr, "Solidbase Bannermanagement" SBbanner, "t3maffiliate" t3maffiliate, "AJAX Chat" vjchat Releas...

Blind SQL Injection vulnerability in extension T3M E-Mail Marketing Tool (t3m)

It has been discovered that the extension T3M E-Mail Marketing Tool t3m is vulnerable to Blind SQL Injection attacks. Release Date: August 18, 2009 Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.2.4 and below...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: "CoolURI" cooluri, "Reset backend password" cwtresetbepassword, "datamints Newsticker" datamintsnewsticker, "Gobernalia Front End News Submitter" gbfenewssubmit, "Mailform" mailform, "Myth download" mythdownloa...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: "FrontEnd MP3 Player" femp3player, "Search In Tables" fesearchintable, "Content Search" gstcontentsearch, "Multilingual Alias" multilingualalias, "Myth Repository" mythrepository and "References database"...

Cross-Site Scripting vulnerability in extension Modern Guestbook / Commenting System (ve_guestbook)

It has been discovered that the extension Modern Guestbook / Commenting system veguestbook is vulnerable to Cross-Site Scripting. Release Date: June 16, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.7.1 and...

TYPO3 Security Bulletin

It has been discovered that the extension Virtual Civil Services civserv is vulnerable to SQL-injections. Release Date: June 16, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.3.2 and all versions below...

TYPO3 Security Bulletin

It has been discovered that the extension CWT Community cwtcommunity is vulnerable to SQL-injections. Release Date: June 16 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.0.3 and all versions below...

Information Disclosure in third party extension "Frontend User registration"

It has been discovered that the TYPO3 extension "Frontend User Registration" srfeuserregister is susceptible to Information Disclosure. Release Date: April 6, 2009 Component Type: Third party extension. This extension is not a part of a TYPO3 default installation. Affected Versions: 2.5.20 and al...