VYPR
← TYPO3

Vendor CVEs

TYPO3

All CVEs

539 total · sorted by risk
  • CVE-2014-3949Jun 4, 2014
    TYPO3
    Grid Elements (gridelements)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the layout wizard in the Grid Elements (gridelements) extension before 1.5.1 and 2.0.x before 2.0.3 for TYPO3 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3948Jun 4, 2014
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3946Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.

  • CVE-2014-3945Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by…

  • CVE-2014-3944Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2014-3943Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via…

  • CVE-2014-3942Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

  • CVE-2014-3941Jun 3, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

  • CVE-2013-4321May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete…

  • CVE-2013-4320May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

  • CVE-2013-4250May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

  • CVE-2012-6146May 20, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.

  • CVE-2014-3759May 16, 2014
    TYPO3
    si_bibtex
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allow remote attackers to execute arbitrary SQL commands via vectors related to the (1) search or (2) list functionality.

  • CVE-2014-3758May 16, 2014
    TYPO3
    BibTex Publications (si_bibtex)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality.

  • CVE-2013-7078Jan 19, 2014
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled,…

  • CVE-2013-7081Dec 23, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.

  • CVE-2013-7080Dec 23, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted…

  • CVE-2013-7079Dec 23, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-7075Dec 23, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified…

  • CVE-2013-7073Dec 23, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.

  • CVE-2013-7082Dec 21, 2013
    TYPO3
    Flow
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned…

  • CVE-2013-7077Dec 21, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-7076Dec 21, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Extension Manager in TYPO3 4.5.x before 4.5.32 and 4.7.x before 4.7.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-7074Dec 21, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML…

  • CVE-2013-5570Aug 23, 2013
    TYPO3
    Javascript and CSS Optimizer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Javascript and CSS Optimizer extension before 1.1.14 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5569Aug 23, 2013
    TYPO3
    Slideshare
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Slideshare extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5310Aug 16, 2013
    TYPO3
    wfqbe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the DB Integration (wfqbe) extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5308Aug 16, 2013
    TYPO3
    RealURL Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RealURL Management (realurlmanagement) extension 0.3.4 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5307Aug 16, 2013
    TYPO3
    ke_search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5306Aug 16, 2013
    TYPO3
    browser
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Browser - TYPO3 without PHP (browser) extension before 4.5.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5305Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5304Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5303Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."

  • CVE-2013-5302Aug 16, 2013
    TYPO3
    ke_search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4870Jul 20, 2013
    TYPO3
    news_search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the News Search (news_search) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4749Jul 1, 2013
    TYPO3
    sys_messages
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the UserTask Center, Messaging (sys_messages) extension 1.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4746Jul 1, 2013
    TYPO3
    myquizpoll
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4745Jul 1, 2013
    TYPO3
    myquizpoll
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-6148Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6147Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6145Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6144Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4721Jun 27, 2013
    TYPO3
    RSS feed from records
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4720Jun 27, 2013
    TYPO3
    Wec Discussion Forum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4719Jun 27, 2013
    TYPO3
    lonewsseo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-6577Jun 27, 2013
    TYPO3
    Formhandler
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Formhandler extension before 1.4.1 for TYPO3 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4681Jun 25, 2013
    TYPO3
    sofortueberweisung2commerce
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4680Jun 25, 2013
    TYPO3
    Maag Form Captcha
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-4634Jun 20, 2013
    TYPO3
    rzautocomplete
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-1843Mar 20, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Page 5 of 11