Skip to content
OpenAdvisories

Package · Packagist

typo3/cms-core

128 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

128 results · Feed

  • Medium —
    CVE-2013-7080

    TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

    The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database …

    typo3/cms-core Packagist
  • Medium —
    CVE-2013-7081

    TYPO3 Improper Access Control vulnerability

    The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via u…

    typo3/cms-core Packagist
  • Medium —
    CVE-2013-7077

    TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module

    Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms-core Packagist
  • Medium 5.3
    CVE-2013-1843

    TYPO3 Open redirect vulnerability in the Access tracking mechanism

    Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspec…

    typo3/cms-core Packagist
  • High 7.4
    CVE-2013-1842

    TYPO3 SQL injection vulnerability in the Extbase Framework

    SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object …

    typo3/cms-core Packagist
  • Medium —
    CVE-2010-5104

    TYPO3 Sensitive Information Disclosure via escapeStrForLike method

    The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information …

    typo3/cms-core Packagist
  • Medium —
    CVE-2009-3633

    TYPO3 API function vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecifie…

    typo3/cms-core Packagist
  • Medium —
    CVE-2008-2717

    TYPO3 Unrestricted File Upload vulnerability

    TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or con…

    typo3/cms-core Packagist