VYPR
← TYPO3

Vendor CVEs

TYPO3

All CVEs

614 total · sorted by risk
  • CVE-2013-5569Aug 23, 2013
    TYPO3
    Slideshare
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Slideshare extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5310Aug 16, 2013
    TYPO3
    wfqbe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the DB Integration (wfqbe) extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5308Aug 16, 2013
    TYPO3
    RealURL Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RealURL Management (realurlmanagement) extension 0.3.4 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5307Aug 16, 2013
    TYPO3
    ke_search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5306Aug 16, 2013
    TYPO3
    browser
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Browser - TYPO3 without PHP (browser) extension before 4.5.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5305Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5304Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5303Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."

  • CVE-2013-5302Aug 16, 2013
    TYPO3
    ke_search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4870Jul 20, 2013
    TYPO3
    news_search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the News Search (news_search) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4749Jul 1, 2013
    TYPO3
    sys_messages
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the UserTask Center, Messaging (sys_messages) extension 1.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4746Jul 1, 2013
    TYPO3
    myquizpoll
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4745Jul 1, 2013
    TYPO3
    myquizpoll
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-6148Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6147Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6145Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6144Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4721Jun 27, 2013
    TYPO3
    RSS feed from records
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4720Jun 27, 2013
    TYPO3
    Wec Discussion Forum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4719Jun 27, 2013
    TYPO3
    lonewsseo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-6577Jun 27, 2013
    TYPO3
    Formhandler
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Formhandler extension before 1.4.1 for TYPO3 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4681Jun 25, 2013
    TYPO3
    sofortueberweisung2commerce
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4680Jun 25, 2013
    TYPO3
    Maag Form Captcha
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-4634Jun 20, 2013
    TYPO3
    rzautocomplete
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-1843Mar 20, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-1842Mar 20, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation…

  • CVE-2012-3531Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3530Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.

  • CVE-2012-3529Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.

  • CVE-2012-3528Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3527Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a…

  • CVE-2012-1608Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.

  • CVE-2012-1607Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.

  • CVE-2012-1606Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1605Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."

  • CVE-2012-2112Aug 27, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.

  • CVE-2010-5104May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard…

  • CVE-2010-5103May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-5102May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in mod/tools/em/class.em_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote attackers to write arbitrary files via unspecified vectors.

  • CVE-2010-5101May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."

  • CVE-2010-5100May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-5098May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-5097May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1087Feb 14, 2012
    TYPO3
    bc_post2facebook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1086Feb 14, 2012
    TYPO3
    Aeurltool
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1085Feb 14, 2012
    TYPO3
    Beuserswitch
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2012-1084Feb 14, 2012
    TYPO3
    Beuserswitch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1083Feb 14, 2012
    TYPO3
    Terminal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-1082Feb 14, 2012
    TYPO3
    Terminal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1081Feb 14, 2012
    TYPO3
    Yet another Google search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Page 7 of 13