VYPR
← TYPO3

Vendor CVEs

TYPO3

All CVEs

572 total · sorted by risk
  • CVE-2015-4612Jun 16, 2015
    TYPO3
    js_faq
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the "FAQ - Frequently Asked Questions" (js_faq) extension before 1.2.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-4611Jun 16, 2015
    TYPO3
    ncgov_smoelenboek
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Smoelenboek (ncgov_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-4609Jun 16, 2015
    TYPO3
    wt_directory
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the wt_directory extension before 1.4.2 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-4608Jun 16, 2015
    TYPO3
    beko_beuserlog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the BE User Log (beko_beuserlog) extension 1.1.1 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-4607Jun 16, 2015
    TYPO3
    feupload
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in the Frontend User Upload (feupload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to…

  • CVE-2015-4606Jun 16, 2015
    TYPO3
    jobfair
    risk 0.00cvss —epss 0.03

    Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the…

  • CVE-2015-2821Apr 1, 2015
    TYPO3
    Neos
    risk 0.00cvss —epss 0.01

    TYPO3 Neos 1.1.x before 1.1.3 and 1.2.x before 1.2.3 allows remote editors to access, create, and modify content nodes in the workspace of other editors via unspecified vectors.

  • CVE-2015-2047Feb 23, 2015
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows remote attackers to bypass authentication via a password that is casted to an empty value.

  • CVE-2015-1405Feb 3, 2015
    TYPO3
    Content Rating Extbase
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-1404Feb 3, 2015
    TYPO3
    Content Rating Extbase
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-1403Feb 3, 2015
    Content Rating Project
    Content Rating
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-1402Feb 3, 2015
    Content Rating Project
    Content Rating
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-9509Jan 4, 2015
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache…

  • CVE-2014-9508Jan 4, 2015
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for…

  • CVE-2014-8874Dec 2, 2014
    TYPO3
    ke_questionnaire
    risk 0.00cvss —epss 0.01

    The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier for remote attackers to obtain sensitive information via a direct request.

  • CVE-2014-8325Oct 22, 2014
    TYPO3
    Calendar Base
    risk 0.00cvss —epss 0.02

    The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resource consumption) via vectors related to the PHP PCRE library.

  • CVE-2014-6299Oct 3, 2014
    TYPO3
    mm_forum
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to hijack the authentication of users for requests that create posts via unspecified vectors.

  • CVE-2014-6298Oct 3, 2014
    TYPO3
    mm_forum
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.

  • CVE-2014-6297Oct 3, 2014
    TYPO3
    mm_forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6294Oct 3, 2014
    TYPO3
    outstats
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the External links click statistics (outstats) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6293Oct 3, 2014
    TYPO3
    ke_stats
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Statistics (ke_stats) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in February 2014.

  • CVE-2014-6291Oct 3, 2014
    TYPO3
    Alphabetic Sitemap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6290Oct 3, 2014
    TYPO3
    tt_news
    risk 0.00cvss —epss 0.01

    The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors related to an "insecure unserialize" issue.

  • CVE-2014-6241Sep 11, 2014
    TYPO3
    wt_directory
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the wt_directory extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-6240Sep 11, 2014
    TYPO3
    Google Sitemap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Google Sitemap (weeaar_googlesitemap) extension 0.4.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6239Sep 11, 2014
    Address Visualization With Google Maps Project
    Address Visualization With Google Maps
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Address visualization with Google Maps (st_address_map) extension before 0.3.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-6238Sep 11, 2014
    TYPO3
    Akronymmanager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Akronymmanager (aka SB Folderdownload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6237Sep 11, 2014
    TYPO3
    News Pack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the News Pack extension 0.1.0 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6236Sep 11, 2014
    TYPO3
    LumoNet PHP Include
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary scripts via vectors related to extension links.

  • CVE-2014-6234Sep 11, 2014
    TYPO3
    jh_opengraphprotocol
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Open Graph protocol (jh_opengraphprotocol) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-6233Sep 11, 2014
    TYPO3
    Flat Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Flat Manager (flatmgr) extension before 2.7.10 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-6232Sep 11, 2014
    TYPO3
    eu_ldap
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the LDAP (eu_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors.

  • CVE-2014-6231Sep 11, 2014
    TYPO3
    cwt_feedit
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the CWT Frontend Edit (cwt_feedit) extension before 1.2.5 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2014-3949Jun 4, 2014
    TYPO3
    Grid Elements (gridelements)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the layout wizard in the Grid Elements (gridelements) extension before 1.5.1 and 2.0.x before 2.0.3 for TYPO3 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3948Jun 4, 2014
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3946Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.

  • CVE-2014-3945Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by…

  • CVE-2014-3944Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2014-3943Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via…

  • CVE-2014-3942Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

  • CVE-2014-3941Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

  • CVE-2013-4321May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete…

  • CVE-2013-4320May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

  • CVE-2013-4250May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

  • CVE-2012-6146May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.

  • CVE-2014-3759May 16, 2014
    TYPO3
    si_bibtex
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allow remote attackers to execute arbitrary SQL commands via vectors related to the (1) search or (2) list functionality.

  • CVE-2014-3758May 16, 2014
    TYPO3
    BibTex Publications (si_bibtex)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality.

  • CVE-2013-7078Jan 19, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled,…

  • CVE-2013-7081Dec 23, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.

  • CVE-2013-7080Dec 23, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted…

Page 5 of 12