Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
807 results · page 13 of 17
Mar 15, 2010SQL injection vulnerability in the Webesse Image Gallery (ws_gallery) extension 1.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL comCVE-2009-4703 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the Webesse Image Gallery (ws_gallery) extension 1.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- WS Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2010SQL injection vulnerability in the Tour Extension (pm_tour) extension before 0.0.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspCVE-2009-4702 · Other software · Markus Barchfeld · reported by MITREHigh 7.5
SQL injection vulnerability in the Tour Extension (pm_tour) extension before 0.0.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- PM Tour
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2010SQL injection vulnerability in the Myth download (myth_download) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspeciCVE-2009-4701 · Other software · Liviu Mitrofan · reported by MITREHigh 7.5
SQL injection vulnerability in the Myth download (myth_download) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Myth Download
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2010SQL injection vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectorCVE-2010-0798 · Other software · Snowflake · reported by MITREHigh 7.5
SQL injection vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- T3blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2010Cross-site scripting (XSS) vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via CVE-2010-0797 · Other software · Snowflake · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- T3blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2010Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a bCVE-2010-0286 · Other software · Typo3 · reported by Red HatMedium 5.1
Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities during authentication.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2010Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.CVE-2010-0664 · Computers, phones & browsers · Google · reported by MITREMedium 5
Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comexchange.kg
Feb 15, 2010A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain priCVE-2010-0288 · Other software · Dokuwiki · reported by Red HatHigh 7.5
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Product
- Dokuwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.splitbrain.orglists.fedoraproject.org
Jan 15, 2010Directory traversal vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 has unknown impact and remote attack vectors.CVE-2010-0350 · Other software · Arco VAN Geest · reported by MITREHigh 7.5
Directory traversal vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 has unknown impact and remote attack vectors.
- Product
- Goof Fotoboek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the VD / Geomap (vd_geomap) extension 0.3.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web scCVE-2010-0347 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the VD / Geomap (vd_geomap) extension 0.3.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- VD Gemomap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the Tip many friends (mimi_tipfriends) extension 0.0.2 and earlier for TYPO3 allows remote attackers to inject arbitCVE-2010-0346 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Tip many friends (mimi_tipfriends) extension 0.0.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Mimi Tipfriends
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the Majordomo extension 1.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML vCVE-2010-0345 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Majordomo extension 1.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Majordomo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the zak_store_management extension 1.0.0 and earlier TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifCVE-2010-0344 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the zak_store_management extension 1.0.0 and earlier TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- ZAK Store Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the Clan Users List (pb_clanlist) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspeciCVE-2010-0343 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the Clan Users List (pb_clanlist) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- PB Clanlist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the Reports for Job (job_reports) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commandsCVE-2010-0342 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the Reports for Job (job_reports) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- JOB Reports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the BB Simple Jobs (bb_simplejobs) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commandCVE-2010-0341 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the BB Simple Jobs (bb_simplejobs) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- BB Simplejobs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the MJS Event Pro (mjseventpro) extension 0.2.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands vCVE-2010-0340 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the MJS Event Pro (mjseventpro) extension 0.2.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Mjseventpro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the User Links (vm19_userlinks) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands vCVE-2010-0339 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the User Links (vm19_userlinks) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Vm19 Userlinks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the TT_Products editor (ttpedit) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands CVE-2010-0338 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the TT_Products editor (ttpedit) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Ttpedit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the tt_news Mail alert (dl3_tt_news_alerts) extension 0.2.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQCVE-2010-0337 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the tt_news Mail alert (dl3_tt_news_alerts) extension 0.2.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Dl3 TT News Alerts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Unspecified vulnerability in the kiddog_mysqldumper (kiddog_mysqldumper) extension 0.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive inforCVE-2010-0336 · Other software · Typo3 · reported by MITREMedium 5
Unspecified vulnerability in the kiddog_mysqldumper (kiddog_mysqldumper) extension 0.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
- Product
- Kiddog Mysqldumper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arCVE-2010-0335 · Other software · Francisco Cifuentes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Vote For TT News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL CVE-2010-0334 · Other software · Francisco Cifuentes · reported by MITREHigh 7.5
SQL injection vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Vote For TT News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecCVE-2010-0333 · Other software · Matthias Graubner · reported by MITREHigh 7.5
SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- MG Help
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commandsCVE-2010-0332 · Other software · Stefan Tannhaeuser · reported by MITREHigh 7.5
SQL injection vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Tv21 Talkshow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary CVE-2010-0331 · Other software · Stefan Tannhaeuser · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Tv21 Talkshow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the Googlemaps for tt_news (jf_easymaps) extension 1.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL cCVE-2010-0330 · Other software · Julian Fries · reported by MITREHigh 7.5
SQL injection vulnerability in the Googlemaps for tt_news (jf_easymaps) extension 1.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- JF Easymaps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vecCVE-2010-0329 · Other software · Alex Kellner · reported by MITREHigh 7.5
SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."
- Product
- Powermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the Unit Converter (cs2_unitconv) extension 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script oCVE-2010-0328 · Other software · Rastislav Birka · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Unit Converter (cs2_unitconv) extension 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Cs2 Unitconv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the KJ: Imagelightbox (kj_imagelightbox2) extension 2.0.0 and earlier for TYPO3 allows remote attackers to inject arCVE-2010-0327 · Other software · Julian Kleinhans · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the KJ: Imagelightbox (kj_imagelightbox2) extension 2.0.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-2490.
- Product
- KJ Imagelightbox2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Cross-site scripting (XSS) vulnerability in the Developer log (devlog) extension 2.9.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web scrCVE-2010-0326 · Other software · Francois Suter · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Developer log (devlog) extension 2.9.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Devlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Unspecified vulnerability in the SB Folderdownload (sb_folderdownload) extension 0.2.2 and earlier for TYPO3 allows remote attackers to obtain sensitive informaCVE-2010-0325 · Other software · Sebastian Baumann · reported by MITREMedium 5
Unspecified vulnerability in the SB Folderdownload (sb_folderdownload) extension 0.2.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
- Product
- SB Folderdownload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the Customer Reference List (ref_list) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL comCVE-2010-0324 · Other software · Patrick Bauerochse · reported by MITREHigh 7.5
SQL injection vulnerability in the Customer Reference List (ref_list) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- REF List
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010Unspecified vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 allows remote attackers to obtain sensitive information via uCVE-2010-0323 · Other software · Arco VAN Geest · reported by MITREHigh 7.8
Unspecified vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
- Product
- Goof Fotoboek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2010SQL injection vulnerability in the init function in MK-AnydropdownMenu (mk_anydropdownmenu) extension 0.3.28 and earlier for TYPO3 allows remote attackers to exCVE-2010-0322 · Other software · Matthias Karr · reported by MITREHigh 7.5
SQL injection vulnerability in the init function in MK-AnydropdownMenu (mk_anydropdownmenu) extension 0.3.28 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- MK Anydropdownmenu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009SQL injection vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to execute arCVE-2009-4401 · Other software · Fr.simon Rundell · reported by MITREHigh 7.5
SQL injection vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- STE Parish Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009Cross-site scripting (XSS) vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers CVE-2009-4400 · Other software · Fr.simon Rundell · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- STE Parish Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009SQL injection vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote CVE-2009-4399 · Other software · Fr.simon Rundell · reported by MITREHigh 7.5
SQL injection vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- HS Religiousartgallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009Cross-site scripting (XSS) vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 aCVE-2009-4398 · Other software · Fr.simon Rundell · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- HS Religiousartgallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Resources Database (pd_resources) extension 0.1.1 and earlier for TYPO3 allows remote attaCVE-2009-4397 · Other software · Fr.simon Rundell · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Resources Database (pd_resources) extension 0.1.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- PD Resources
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009SQL injection vulnerability in the Diocese of Portsmouth Resources Database (pd_resources) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execCVE-2009-4396 · Other software · Fr.simon Rundell · reported by MITREHigh 7.5
SQL injection vulnerability in the Diocese of Portsmouth Resources Database (pd_resources) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- PD Resources
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009Cross-site scripting (XSS) vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary CVE-2009-4395 · Other software · Fr.simon Rundell · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- STE Prayer2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commandsCVE-2009-4394 · Other software · Fr.simon Rundell · reported by MITREHigh 7.5
SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- STE Prayer2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009SQL injection vulnerability in the Document Directorys (danp_documentdirs) extension 1.10.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SCVE-2009-4393 · Other software · Daniel Ptzinger · reported by MITREHigh 7.5
SQL injection vulnerability in the Document Directorys (danp_documentdirs) extension 1.10.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Danp Documentdirs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009SQL injection vulnerability in the XDS Staff List (xds_staff) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands viCVE-2009-4392 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the XDS Staff List (xds_staff) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- XDS Staff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009Cross-site scripting (XSS) vulnerability in the File list (dr_blob) extension 2.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML viaCVE-2009-4391 · Other software · Daniel Regelein · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the File list (dr_blob) extension 2.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- DR Blob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009SQL injection vulnerability in the Car (car) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2009-4390 · Other software · Jochen Rieger · reported by MITREHigh 7.5
SQL injection vulnerability in the Car (car) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- CAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009Unspecified vulnerability in the Watchdog (aba_watchdog) extension 2.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknoCVE-2009-4389 · Other software · Robert Puntigam · reported by MITREMedium 5
Unspecified vulnerability in the Watchdog (aba_watchdog) extension 2.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
- Product
- ABA Watchdog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2009Cross-site scripting (XSS) vulnerability in the ListMan (nl_listman) extension 1.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML viCVE-2009-4388 · Other software · Frank Krger · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the ListMan (nl_listman) extension 1.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- NL Listman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2009Cross-site scripting (XSS) vulnerability in the Frontend news submitter with RTE (fe_rtenews) extension 1.4.1 and earlier for TYPO3 allows remote attackers to iCVE-2009-4346 · Other software · Toni Milovan · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Frontend news submitter with RTE (fe_rtenews) extension 1.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- FE Rtenews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.