typo3-src - several

Fixed packages 2

Vulnerabilities 8

• Medium 6.5
  CVE-2013-7073

  TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component

  The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecifie…

  typo3/cms Packagist
  Dec 23, 2013
• Medium 6.3
  CVE-2013-7075

  TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component

  The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have …

  typo3/cms Packagist
  Dec 23, 2013
• Low 3.0
  CVE-2013-7074

  TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component

  Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary…

  typo3/cms Packagist
  Dec 21, 2013
• Unscored —
  CVE-2013-7076

  Cross-site scripting (XSS) vulnerability in Extension Manager in TYPO3 4.5.x before 4.5.32 and 4.7.x before 4.7.17 allo…

  Dec 21, 2013
• Low —
  CVE-2013-7078

  TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework

  Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapp…

  typo3/cms-core Packagist
  Jan 19, 2014
• Medium —
  CVE-2013-7079

  TYPO3 OpenID extension Open redirect vulnerability

  Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecifie…

  friendsoftypo3/openid Packagist
  Dec 23, 2013
• Medium —
  CVE-2013-7080

  TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

  The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database …

  typo3/cms-core Packagist
  Dec 23, 2013
• Medium —
  CVE-2013-7081

  TYPO3 Improper Access Control vulnerability

  The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via u…

  typo3/cms-core Packagist
  Dec 23, 2013