VYPR
← TYPO3

Vendor CVEs

TYPO3

All CVEs

572 total · sorted by risk
  • CVE-2010-5097May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1087Feb 14, 2012
    TYPO3
    bc_post2facebook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1086Feb 14, 2012
    TYPO3
    Aeurltool
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1085Feb 14, 2012
    TYPO3
    Beuserswitch
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2012-1084Feb 14, 2012
    TYPO3
    Beuserswitch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1083Feb 14, 2012
    TYPO3
    Terminal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-1082Feb 14, 2012
    TYPO3
    Terminal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1081Feb 14, 2012
    TYPO3
    Yet another Google search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1080Feb 14, 2012
    TYPO3
    Euro Calculator (skt_eurocalc)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1079Feb 14, 2012
    TYPO3
    typo3_webservice
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2012-1078Feb 14, 2012
    TYPO3
    sysutils
    risk 0.00cvss —epss 0.01

    The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper "protection" of the "backup output directory."

  • CVE-2012-1077Feb 14, 2012
    TYPO3
    bc_post2facebook
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1076Feb 14, 2012
    TYPO3
    rtg_files
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1075Feb 14, 2012
    TYPO3
    rtg_files
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1074Feb 14, 2012
    TYPO3
    White Papers
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1073Feb 14, 2012
    TYPO3
    Toi Category
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1072Feb 14, 2012
    TYPO3
    Category-System
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1071Feb 14, 2012
    TYPO3
    mv_cooking
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild as of February 2012.

  • CVE-2012-1070Feb 14, 2012
    TYPO3
    irfaq
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter."

  • CVE-2011-5079Feb 14, 2012
    TYPO3
    irfaq
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "return url parameter."

  • CVE-2010-4960Oct 9, 2011
    TYPO3
    mh_branchenbuch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Branchenbuch (aka Yellow Pages or mh_branchenbuch) extension before 0.9.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4957Oct 9, 2011
    TYPO3
    ke_questionnaire
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4956Oct 9, 2011
    TYPO3
    ke_questionnaire
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4953Oct 9, 2011
    Jw Calendar
    Jw Calendar
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the JW Calendar (jw_calendar) extension 1.3.20 and earlier for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2010-4952Oct 9, 2011
    TYPO3
    festat
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the FE user statistic (festat) extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4951Oct 9, 2011
    TYPO3
    xaJax Shoutbox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the xaJax Shoutbox (vx_xajax_shoutbox) extension before 1.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4950Oct 9, 2011
    TYPO3
    Event
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Event (event) extension before 0.3.7 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4892Oct 7, 2011
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the powermail extension before 1.5.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4890Oct 7, 2011
    TYPO3
    ke_yac
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4889Oct 7, 2011
    TYPO3
    Tiny Market
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.

  • CVE-2010-4888Oct 7, 2011
    TYPO3
    Tiny Market
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4887Oct 7, 2011
    TYPO3
    commentsbe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Commenting system Backend Module (commentsbe) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4885Oct 7, 2011
    TYPO3
    XING Button
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the XING Button (xing) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1722Apr 19, 2011
    TYPO3
    Wec Discussion
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in WEC Discussion Forum (wec_discussion) extension 2.1.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in April 2011.

  • CVE-2010-4068Oct 25, 2010
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administrators to read and possibly modify arbitrary files via a crafted parameter, a different vulnerability than…

  • CVE-2010-3717Oct 25, 2010
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTER_VALIDATE_EMAIL operations in PHP, which allows remote attackers to cause a denial of service (memory consumption and…

  • CVE-2010-3716Oct 25, 2010
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships.

  • CVE-2010-3715Oct 25, 2010
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function, and allow remote authenticated users to…

  • CVE-2010-3714Oct 25, 2010
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.25

    The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary…

  • CVE-2010-3687Sep 29, 2010
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to bypass validation have an unspecified impact by "[injecting] arbitrary values into validated fields," as demonstrated using the (1) Email and (2) URL fields.

  • CVE-2010-3605Sep 24, 2010
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4971Jul 28, 2010
    TYPO3
    AJAX Chat
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the AJAX Chat (vjchat) extension before 0.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4970Jul 28, 2010
    TYPO3
    t3m_affiliate
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the t3m_affiliate extension 0.5.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4969Jul 28, 2010
    TYPO3
    SBbanner
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4968Jul 28, 2010
    TYPO3
    Event Registration
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Event Registration (event_registr) extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4967Jul 28, 2010
    TYPO3
    Car
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Car (car) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4966Jul 28, 2010
    TYPO3
    AST ZipCodeSearch
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the AST ZipCodeSearch (ast_addresszipsearch) extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4965Jul 28, 2010
    TYPO3
    AIRware Lexicon
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the AIRware Lexicon (air_lexicon) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4963Jul 28, 2010
    TYPO3
    Commerce Extension
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4959Jul 28, 2010
    TYPO3
    T3M E-Mail Marketing Tool
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the T3M E-Mail Marketing Tool (t3m) extension 0.2.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Page 7 of 12