Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
730 results · page 9 of 15
Jul 1, 2013Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote aCVE-2012-6145 · Other software · Typo3 · reported by Red HatLow 3.5
Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2013SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated CVE-2012-6144 · Other software · Typo3 · reported by Red HatMedium 6.5
SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2013SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unsCVE-2013-4721 · Other software · 3ds · reported by MITREHigh 7.5
SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Push2rss 3ds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2013SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifiCVE-2013-4720 · Other software · Webempoweredchurch · reported by MITREHigh 7.5
SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- WEC Discussion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2013SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifiCVE-2013-4719 · Other software · Lina Wolf · reported by MITREHigh 7.5
SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- SEO Pack For TT News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2013SQL injection vulnerability in the Formhandler extension before 1.4.1 for TYPO3 allows remote authenticated users with certain permissions to execute arbitrary CVE-2012-6577 · Other software · Typoheads · reported by MITREMedium 6
SQL injection vulnerability in the Formhandler extension before 1.4.1 for TYPO3 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.
- Product
- Formhandler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2013SQL injection vulnerability in the meta_feedit extension 0.1.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2013-4683 · Other software · Christophe Balisky · reported by MITREHigh 7.5
SQL injection vulnerability in the meta_feedit extension 0.1.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Meta Feedit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2013SQL injection vulnerability in the Multishop extension before 2.0.39 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectorsCVE-2013-4682 · Other software · BAS VAN Beek · reported by MITREHigh 7.5
SQL injection vulnerability in the Multishop extension before 2.0.39 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Multishop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2013SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unCVE-2013-4681 · Websites & servers · Michael Staatz · reported by MITREHigh 7.5
SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Sofortueberweisung2commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2013Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and condCVE-2013-4680 · Other software · URS Maag · reported by MITREMedium 6.4
Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Product
- Maag Form Captcha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2013SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute aCVE-2013-4634 · Other software · Raphael Zschorsch · reported by MITREHigh 7.5
SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Rzautocomplete
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2013Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allowCVE-2013-1843 · Other software · Typo3 · reported by Red HatMedium 6.4
Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgsecunia.com
Mar 20, 2013SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remoteCVE-2013-1842 · Other software · Typo3 · reported by Red HatHigh 7.5
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgosvdb.org
Nov 17, 2012The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) ediCVE-2012-5890 · Other software · Stanislas Rolland · reported by MITREMedium 5
The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature.
- Product
- SR Feuser Register
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforge.typo3.orgforge.typo3.org
Nov 17, 2012Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unCVE-2012-5889 · Other software · Alex Kellner · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Powermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgexchange.xforce.ibmcloud.com
Nov 17, 2012Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web scrCVE-2012-5888 · Other software · Benjamin Mack · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- SEO Basics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforge.typo3.orgtypo3.org
Sep 5, 2012Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers toCVE-2012-3531 · Other software · Typo3 · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2012Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows rCVE-2012-3530 · Other software · Typo3 · reported by Red HatMedium 4.3
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2012The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obCVE-2012-3529 · Other software · Typo3 · reported by Red HatLow 3.5
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2012Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authentCVE-2012-3528 · Other software · Typo3 · reported by Red HatLow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2012view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to uCVE-2012-3527 · Other software · Typo3 · reported by Red HatMedium 4.6
view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2012The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass theCVE-2012-1608 · Other software · Typo3 · reported by Red HatMedium 5
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2012The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtainCVE-2012-1607 · Other software · Typo3 · reported by Red HatMedium 5
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and CVE-2012-1606 · Other software · Typo3 · reported by Red HatLow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2012The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects andCVE-2012-1605 · Other software · Typo3 · reported by Red HatMedium 5
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2012Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote aCVE-2012-2112 · Other software · Typo3 · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.typo3.orglists.typo3.org
May 30, 2012The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not proCVE-2010-5099 · Other software · Typo3 · reported by Red HatMedium 6.8
The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nibblesec.orgsecunia.com
May 21, 2012The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is sCVE-2010-5104 · Other software · Typo3 · reported by Red HatMedium 4.3
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2012SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with cCVE-2010-5103 · Other software · Typo3 · reported by Red HatMedium 6
SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2012Directory traversal vulnerability in mod/tools/em/class.em_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4CVE-2010-5102 · Other software · Typo3 · reported by Red HatMedium 5
Directory traversal vulnerability in mod/tools/em/class.em_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote attackers to write arbitrary files via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.typo3.orgsecunia.com
May 21, 2012Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated aCVE-2010-5101 · Other software · Typo3 · reported by Red HatMedium 4
Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote auCVE-2010-5100 · Other software · Typo3 · reported by Red HatLow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2012Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authCVE-2010-5098 · Other software · Typo3 · reported by Red HatLow 3.5
Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2012Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enaCVE-2010-5097 · Other software · Typo3 · reported by Red HatLow 2.6
Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2012PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x beforCVE-2011-4614 · Other software · Typo3 · reported by Red HatMedium 6.8
PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACK_PATH parameter.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to injCVE-2012-1087 · Other software · Bluechip · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- BC Post2facebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML viaCVE-2012-1086 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Aeurltool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vecCVE-2012-1085 · Other software · Typo3 · reported by MITREMedium 5
Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
- Product
- Beuserswitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script oCVE-2012-1084 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Beuserswitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack theCVE-2012-1083 · Other software · Typo3 · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
- Product
- Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject CVE-2012-1082 · Other software · Typo3 · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject CVE-2012-1081 · Other software · Roderick Braun · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- YA Googlesearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML viCVE-2012-1080 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- SKT Eurocalc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrarCVE-2012-1079 · Other software · Helmut Hummel · reported by MITREMedium 6.5
Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.
- Product
- Typo3 Webservice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related toCVE-2012-1078 · Other software · Claus DUE · reported by MITREMedium 5
The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper "protection" of the "backup output directory."
- Product
- Sysutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrarCVE-2012-1077 · Other software · Manfred Egger · reported by MITREHigh 7.5
SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- BC Post2facebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web CVE-2012-1076 · Other software · Robert Gonda · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- RTG Files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands viaCVE-2012-1075 · Other software · Robert Gonda · reported by MITREHigh 7.5
SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- RTG Files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via CVE-2012-1074 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- MM Whtppr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitraryCVE-2012-1073 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- TOI Category
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.