Filtered by vendor Typo3
Subscriptions
Total
480 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2010-0286 | 1 Typo3 | 1 Typo3 | 2024-08-07 | N/A |
Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities during authentication. | ||||
CVE-2011-4904 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 6.5 Medium |
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services. | ||||
CVE-2011-4902 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 6.5 Medium |
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver. | ||||
CVE-2011-4900 | 2 Debian, Typo3 | 2 Debian Linux, Typo3 | 2024-08-07 | 6.5 Medium |
TYPO3 before 4.5.4 allows Information Disclosure in the backend. | ||||
CVE-2011-4901 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 6.5 Medium |
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database. | ||||
CVE-2011-4903 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 6.1 Medium |
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function. | ||||
CVE-2011-4626 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 6.1 Medium |
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function. | ||||
CVE-2011-4631 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 5.4 Medium |
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler. | ||||
CVE-2011-4630 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 5.4 Medium |
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard. | ||||
CVE-2011-4629 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 5.4 Medium |
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel. | ||||
CVE-2011-4632 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 5.4 Medium |
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message. | ||||
CVE-2011-4628 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 9.8 Critical |
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request. | ||||
CVE-2011-4627 | 1 Typo3 | 1 Typo3 | 2024-08-07 | 6.5 Medium |
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend. | ||||
CVE-2011-3980 | 2 Jerome Schneider, Typo3 | 2 Ameos Dragndropupload, Typo3 | 2024-08-06 | N/A |
Unspecified vulnerability in the Drag Drop Mass Upload (ameos_dragndropupload) extension 2.0.2 and earlier for TYPO3 allows remote attackers to upload arbitrary files via unknown vectors. | ||||
CVE-2011-3583 | 1 Typo3 | 1 Typo3 | 2024-08-06 | 9.8 Critical |
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input. | ||||
CVE-2011-1722 | 2 Typo3, Webempoweredchurch | 2 Typo3, Wec Discussion | 2024-08-06 | N/A |
Multiple SQL injection vulnerabilities in WEC Discussion Forum (wec_discussion) extension 2.1.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in April 2011. | ||||
CVE-2012-6577 | 2 Typo3, Typoheads | 2 Typo3, Formhandler | 2024-08-06 | N/A |
SQL injection vulnerability in the Formhandler extension before 1.4.1 for TYPO3 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors. | ||||
CVE-2012-6147 | 1 Typo3 | 1 Typo3 | 2024-08-06 | N/A |
Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. | ||||
CVE-2012-6148 | 1 Typo3 | 1 Typo3 | 2024-08-06 | N/A |
Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. | ||||
CVE-2012-6144 | 1 Typo3 | 1 Typo3 | 2024-08-06 | N/A |
SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors. |