Skip to content
OpenAdvisories
Critical DSA-2289-1 12 CVEs

typo3-src - several

Published Aug 7, 2011 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 5.0 typo3-src 4.2.5-1+lenny8
Debian · 6.0 typo3-src 4.3.9+dfsg1-1+squeeze1

Vulnerabilities 12

  • Critical 9.8
    CVE-2011-4628

    Typo3 Authentication Bypass

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 6.5
    CVE-2011-4627

    Typo3 Information Disclosure

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 6.5
    CVE-2011-4900

    Typo3 Information Disclosure

    TYPO3 before 4.5.4 allows Information Disclosure in the backend.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 6.5
    CVE-2011-4901

    Typo3 Arbitrary Information Disclosure

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 6.5
    CVE-2011-4902

    Typo3 Arbitrary File Delete

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 6.5
    CVE-2011-4904

    Typo3 Improper Access Control

    TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 6.1
    CVE-2011-4903

    Typo3 XSS in RemoveXSS function

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 5.4
    CVE-2011-4630

    Typo3 XSS Vulnerability

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Medium 5.4
    CVE-2011-4632

    Typo3 XSS Vulnerabilities

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Unscored —
    CVE-2011-4626

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers t…

    TYPO3 typo3 Web / CMS
  • Unscored —
    CVE-2011-4629

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers t…

    TYPO3 typo3 Web / CMS
  • Unscored —
    CVE-2011-4631

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers t…

    TYPO3 typo3 Web / CMS