Skip to content
OpenAdvisories

Package · Packagist

typo3/cms

188 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

129 results · Clear filters · Feed

  • Medium —
    CVE-2012-1605

    Typo3 Extbase Framework Unsafe Deserialization

    The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request a…

    typo3/cms Packagist
  • Medium —
    CVE-2012-1607

    TYPO3 allows remote attackers to obtain the database name via a direct request

    The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.

    typo3/cms Packagist
  • Medium —
    CVE-2012-2112

    Typo3 Exception Handler XSS

    Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.

    typo3/cms Packagist
  • Medium —
    CVE-2010-5099 Public exploit

    TYPO3 Path Traversal vulnerability

    The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and a…

    typo3/cms Packagist
  • Medium —
    CVE-2010-5103

    TYPO3 SQL Injection vulnerability

    SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

    typo3/cms Packagist
  • Medium —
    CVE-2010-5101

    TYPO3 Directory Traversal vulnerability

    Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functi…

    typo3/cms Packagist
  • Medium —
    CVE-2009-3635

    TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential

    The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.

    typo3/cms Packagist
  • Medium —
    CVE-2009-0816

    Typo3 Backend XSS Vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified…

    typo3/cms Packagist
  • Medium —
    CVE-2009-0815 Public exploit EPSS 42%

    TYPO3 leaks a hash secret in an error message

    The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by includin…

    typo3/cms Packagist