TY
Product
typo3
220
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 35Medium 96Low 4
Watch
Add typo3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-4320 | – | May 20 | The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read… Affected: 6.1; 6.1.1; 6.1.2; 6.1.3; 6.0; 6.0.1; +7 more |
| CVE-2013-4250 | – | May 20 | The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote… Affected: 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +6 more |
| CVE-2012-6146 | – | May 20 | The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors… Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; +34 more |
| CVE-2013-7078 | – | Jan 19 | Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16,… Affected: 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +34 more |
| CVE-2013-7081 | – | Dec 23 | The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to… Affected: 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +34 more |
| CVE-2013-7080 | – | Dec 23 | The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11… Affected: 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +34 more |
| CVE-2013-7079 | – | Dec 23 | Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +34 more |
| CVE-2013-7075 | – | Dec 23 | The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users… Affected: 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +34 more |
| CVE-2013-7073 | – | Dec 23 | The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +34 more |
| CVE-2013-7077 | – | Dec 21 | Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary… Affected: 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +13 more |
| CVE-2013-7076 | – | Dec 21 | Cross-site scripting (XSS) vulnerability in Extension Manager in TYPO3 4.5.x before 4.5.32 and 4.7.x before 4.7.17 allows remote attackers to inject arbitrary web script or HTML… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +34 more |
| CVE-2013-7074 | – | Dec 21 | Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the… Affected: 6.1; 6.1.1; 6.1.2; 6.1.3; 6.1.4; 6.1.5; +34 more |
| CVE-2012-6148 | – | Jul 1 | Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +34 more |
| CVE-2012-6147 | – | Jul 1 | Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +34 more |
| CVE-2012-6145 | – | Jul 1 | Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +34 more |
| CVE-2012-6144 | – | Jul 1 | SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +34 more |
| CVE-2013-1843 | – | Mar 20 | Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +34 more |
| CVE-2013-1842 | – | Mar 20 | SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +34 more |
| CVE-2012-3531 | – | Sep 5 | Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +32 more |
| CVE-2012-3530 | – | Sep 5 | Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +32 more |
| CVE-2012-3529 | – | Sep 5 | The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +32 more |
| CVE-2012-3528 | – | Sep 5 | Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend… Affected: 4.5; 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; +32 more |
| CVE-2012-3527 | – | Sep 5 | view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize… Affected: 4.5.0 before 4.5.19; 4.6.0 before 4.6.12; 4.7.0 before 4.7.4 |
| CVE-2012-1608 | – | Sep 4 | The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site… Affected: 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; +31 more |
| CVE-2012-1607 | – | Sep 4 | The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name… Affected: 4.4; 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; +34 more |
| CVE-2012-1606 | – | Sep 4 | Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote… Affected: 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; +31 more |
| CVE-2012-1605 | – | Sep 4 | The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute… Affected: 4.6; 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; +4 more |
| CVE-2012-2112 | – | Aug 27 | Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject… Affected: 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; +33 more |
| CVE-2010-5099 | – | May 30 | The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +24 more |
| CVE-2010-5104 | – | May 21 | The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +23 more |
| CVE-2010-5103 | – | May 21 | SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +23 more |
| CVE-2010-5102 | – | May 21 | Directory traversal vulnerability in mod/tools/em/class.em_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +23 more |
| CVE-2010-5101 | – | May 21 | Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +23 more |
| CVE-2010-5100 | – | May 21 | Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users… Affected: 4.2; 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; +26 more |
| CVE-2010-5098 | – | May 21 | Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to… Affected: 4.2; 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; +26 more |
| CVE-2010-5097 | – | May 21 | Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote… Affected: 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; 4.3.5; +8 more |
| CVE-2011-4614 | – | Feb 18 | PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and… Affected: 4.5; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +5 more |
| CVE-2010-4068 | – | Oct 25 | Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administrators to read and… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +20 more |
| CVE-2010-3717 | – | Oct 25 | The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTER_VALIDATE_EMAIL… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +20 more |
| CVE-2010-3716 | – | Oct 25 | The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +16 more |
| CVE-2010-3715 | – | Oct 25 | Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +20 more |
| CVE-2010-3714 | – | Oct 25 | The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +20 more |
| CVE-2009-4855 | – | May 11 | SQL injection vulnerability in index.php in TYPO3 4.0 allows remote attackers to execute arbitrary SQL commands via the showUid parameter Affected: 4.0 |
| CVE-2010-1153 | – | Apr 20 | PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated… Affected: 4.3.0; 4.3.1; 4.3.2 |
| CVE-2010-0286 | – | Feb 22 | Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account… Affected: 4.3.0 |
| CVE-2009-3636 | – | Nov 2 | Cross-site scripting (XSS) vulnerability in the Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows… Affected: through 4.0.12; 0.1.2; 1.0.14; 1.1; 1.1.1; 1.1.09; +34 more |
| CVE-2009-3635 | – | Nov 2 | The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only… Affected: through 4.0.12; 0.1.2; 1.0.14; 1.1; 1.1.1; 1.1.09; +34 more |
| CVE-2009-3634 | – | Nov 2 | Cross-site scripting (XSS) vulnerability in the Frontend Login Box (aka felogin) subcomponent in TYPO3 4.2.0 through 4.2.6 allows remote attackers to inject arbitrary web script… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.4; 4.2.5; 4.2.6 |
| CVE-2009-3633 | – | Nov 2 | Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before… Affected: through 4.0.12; 0.1.2; 1.0.14; 1.1; 1.1.1; 1.1.09; +34 more |
| CVE-2009-3632 | – | Nov 2 | SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10,… Affected: through 4.0.13; 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +34 more |