Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
807 results · page 5 of 17
Jul 12, 2022The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.CVE-2022-33157 · Other software · Libconnect Project · reported by MITREMedium 6.1
The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.
- Product
- Libconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.CVE-2022-33156 · Other software · Matomo · reported by MITREMedium 6.1
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
- Product
- Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The gridelements (aka Grid Elements) extension through 7.6.1, 8.x through 8.7.0, 9.x through 9.7.0, and 10.x through 10.2.0 extension for TYPO3 allows XSS.CVE-2022-29602 · Other software · Grid Elements Project · reported by MITREMedium 5.4
The gridelements (aka Grid Elements) extension through 7.6.1, 8.x through 8.7.0, 9.x through 9.7.0, and 10.x through 10.2.0 extension for TYPO3 allows XSS.
- Product
- Grid Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allowsCVE-2022-33155 · Other software · Ameos Tarteaucitron Project · reported by MITREMedium 5.4
The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allows XSS.
- Product
- Ameos Tarteaucitron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.CVE-2022-33154 · Other software · Schema Project · reported by MITREMedium 5.4
The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.
- Product
- Schema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The seminars (aka Seminar Manager) extension through 4.1.3 for TYPO3 allows SQL Injection.CVE-2022-29601 · Other software · Oliverklee · reported by MITRECritical 9.8
The seminars (aka Seminar Manager) extension through 4.1.3 for TYPO3 allows SQL Injection.
- Product
- Seminars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The oelib (aka One is Enough Library) extension through 4.1.5 for TYPO3 allows SQL Injection.CVE-2022-29600 · Other software · Oliverklee · reported by MITRECritical 9.8
The oelib (aka One is Enough Library) extension through 4.1.5 for TYPO3 allows SQL Injection.
- Product
- Oelib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31050 · Other software · TYPO3 · reported by GitHubMedium 6
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31049 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31048 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31047 · Other software · TYPO3 · reported by GitHubMedium 5.3
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31046 · Other software · TYPO3 · reported by GitHubMedium 4.3
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used.CVE-2015-3298 · Other software · Yubico · reported by MITREHigh 8.8
Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated.
- Product
- Ykneo-openpgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.yubico.comdevelopers.yubico.com
Feb 18, 2022An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3.CVE-2022-24980 · Other software · Kitodo · reported by MITREHigh 7.5
An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.
- Product
- Kitodo.presentation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3.CVE-2022-24979 · Other software · Mittwald · reported by MITREMedium 5.3
An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer component does not include an access check. This allows an unauthenticated user to render various content elements, resulting in insecure direct object reference (IDOR), with the potential of exposing internal content elements.
- Product
- Varnishcache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3.CVE-2021-43564 · Other software · JOB Fair Project · reported by MITREHigh 7.5
An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).
- Product
- JOB Fair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3.CVE-2021-43563 · Other software · Pixxio · reported by MITREHigh 8.8
An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to download various media files from the DAM system.
- Product
- Pixx.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3.CVE-2021-43562 · Other software · Pixxio · reported by MITREHigh 8.8
An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it to a user-controlled filename, which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this.
- Product
- Pixx.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3.CVE-2021-43561 · Other software · Pega-sus · reported by MITREMedium 5.4
An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
- Product
- Google For Jobs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-41114 · Other software · TYPO3 · reported by GitHubMedium 4.8
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-41113 · Other software · TYPO3 · reported by GitHubHigh 8.8
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as described in TYPO3-CORE-SA-2020-006 (CVE-2020-11069). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system. To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time. The following Same-Site cookie settings in $GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite] are required for an attack to be successful: SameSite=strict: malicious evil.example.org invoking TYPO3 application at good.example.org and SameSite=lax or none: malicious evil.com invoking TYPO3 application at example.org. Update your instance to TYPO3 version 11.5.0 which addresses the problem described.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021Google Fonts Typography: Does not escape and sanitise some of its block settingsCVE-2021-24637 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
- Product
- Google Fonts Typography
- Fixed in
- 3.0.3
- What to do
- Update Google Fonts Typography to 3.0.3 or newer.
Aug 19, 2021Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mathjax configuration error in the mathematiCVE-2020-18748 · Other software · Typora · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mathjax configuration error in the mathematical formula blocks. This is a different vulnerability from CVE-2020-18221.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 20212TypoFR: Reflected Cross-Site ScriptingCVE-2021-34657 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11.
- Product
- 2TypoFR
- Affected
- up to 0.11
- What to do
- Affects up to 0.11. Update 2TypoFR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 13, 2021The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transienCVE-2021-38623 · Other software · Deferred Image Processing Project · reported by MITREHigh 7.5
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
- Product
- Deferred Image Processing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.CVE-2021-38302 · Other software · Newsletter Project · reported by MITRECritical 9.8
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
- Product
- Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a sessiCVE-2021-36793 · Other software · Routes Project · reported by MITREHigh 7.5
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
- Product
- Routes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.CVE-2021-36792 · Other software · Dated News Project · reported by MITREHigh 7.2
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.CVE-2021-36791 · Other software · Dated News Project · reported by MITREMedium 5.3
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.CVE-2021-36790 · Other software · Dated News Project · reported by MITREMedium 6.1
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.CVE-2021-36789 · Other software · Dated News Project · reported by MITRECritical 9.8
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.CVE-2021-36788 · Other software · Yoast · reported by MITREMedium 5.4
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.
- Product
- Yoast SEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.CVE-2021-36787 · Other software · In2code · reported by MITREMedium 5.4
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
- Product
- Femanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 13, 2021The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.CVE-2021-36786 · Other software · Miniorange · reported by MITREHigh 7.5
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
- Product
- Saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.CVE-2021-36785 · Other software · Miniorange · reported by MITREMedium 5.4
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.
- Product
- Saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-32768 · Other software · TYPO3 · reported by GitHubMedium 6.1
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32767 · Other software · TYPO3 · reported by GitHubMedium 5.3
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32669 · Other software · TYPO3 · reported by GitHubMedium 6.4
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this vulnerability.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32668 · Other software · TYPO3 · reported by GitHubMedium 6.4
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32667 · Other software · TYPO3 · reported by GitHubMedium 6.4
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2021Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a matCVE-2020-18221 · Other software · Typora · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a mathematical formula.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.CVE-2021-31779 · Other software · Yoast · reported by MITREMedium 6.4
The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
- Product
- Yoast SEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.CVE-2021-31778 · Other software · Media2click Project · reported by MITREMedium 5.4
The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
- Product
- Media2click
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user accoCVE-2021-31777 · Other software · Dynamic Content Elements Project · reported by MITREMedium 4.9
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
- Product
- Dynamic Content Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcds.thalesgroup.com
Apr 27, 2021Bootstrap Package is a theme for TYPO3.CVE-2021-21365 · Other software · benjaminkott · reported by GitHubMedium 5.4
Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custom code must manually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described. Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/.
- Product
- bootstrap_package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21370 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21359 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21358 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21357 · Other software · TYPO3 · reported by GitHubHigh 8.3
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21355 · Other software · TYPO3 · reported by GitHubHigh 8.6
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, _UploadedFileReferenceConverter_ transforming uploaded files into proper FileReference domain model objects handles possible file uploads for other extensions as well - given those extensions use the Extbase MVC framework, make use of FileReference items in their direct or inherited domain model definitions and did not implement their own type converter. In case this scenario applies, _UploadedFileReferenceConverter_ accepts any file mime-type and persists files in the default location. In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exp
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.