typo3-src - several vulnerabilities

Fixed packages 1

Vulnerabilities 16

• High 8.8
  CVE-2010-3662

  TYPO3 SQL injection vulnerability on the backend

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.

  typo3/cms-backend Packagist
  Nov 4, 2019
• High 8.8
  CVE-2010-3663

  TYPO3 Arbitrary Code Execution vulnerability on the backend

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

  typo3/cms-backend Packagist
  Nov 4, 2019
• Medium 6.5
  CVE-2010-3664

  TYPO3 is vulnerable to Information Disclosure on the backend

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend.

  typo3/cms-backend Packagist
  Nov 4, 2019
• Medium 6.5
  CVE-2010-3671

  TYPO3 is vulnerable to Session Fixation

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session.

  typo3/cms-install Packagist
  Nov 5, 2019
• Medium 6.1
  CVE-2010-3661

  TYPO3 Open Redirection vulnerability on the backend

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend.

  typo3/cms-backend Packagist
  Nov 1, 2019
• Medium 6.1
  CVE-2010-3672

  TYPO3 vulnerable to Cross-Site Scripting in the textarea view helper

  TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension.

  typo3/cms-fluid Packagist
  Nov 5, 2019
• Medium 5.4
  CVE-2010-3659

  TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms

  Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to…

  typo3/cms-backend Packagist
  Oct 20, 2017
• Medium 5.4
  CVE-2010-3660

  TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backend

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.

  typo3/cms-backend Packagist
  Nov 1, 2019
• Medium 5.3
  CVE-2010-3666

  TYPO3 is vulnerable to Insecure randomness in uniqid function

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function.

  typo3/cms-install Packagist
  Nov 4, 2019
• Medium 5.3
  CVE-2010-3667

  TYPO3 is vulnerable to Spam Abuse in the native form content element

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element.

  typo3/cms-frontend Packagist
  Nov 4, 2019
• Medium 5.3
  CVE-2010-3673

  TYPO3 is vulnerable to Information Disclosure in the HTML mailing API

  TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.

  typo3/cms-core Packagist
  Nov 5, 2019
• Medium 4.8
  CVE-2010-3670

  TYPO3 is vulnerable to insecure randomness during hash generation in forgot password function

  TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function.

  typo3/cms-frontend Packagist
  Nov 5, 2019
• Unscored —
  CVE-2010-3665

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.

  Nov 4, 2019
• Unscored —
  CVE-2010-3668

  TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secu…

  Nov 4, 2019
• Unscored —
  CVE-2010-3669

  TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login bo…

  Nov 4, 2019
• Unscored —
  CVE-2010-3674

  TYPO3 before 4.4.1 allows XSS in the frontend search box.

  Nov 5, 2019