Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
730 results · page 4 of 15
Feb 1, 2023An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3.CVE-2023-25014 · Other software · In2code · reported by MITREHigh 8.6
An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users.
- Product
- Femanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3.CVE-2023-25013 · Other software · In2code · reported by MITREHigh 8.6
An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.
- Product
- Femanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical.CVE-2016-15017 · Other software · fabarea · reported by VulDBMedium 5.5
A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.
- Product
- media_upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5 on TYPO3.CVE-2019-25094 · Other software · innologi · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5 on TYPO3. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.6 is able to address this issue. The identifier of the patch is 986d3cb34e5e086c6f04e061f600ffc5837abe7f. It is recommended to upgrade the affected component. The identifier VDB-217353 was assigned to this vulnerability.
- Product
- appointments Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3.CVE-2022-47407 · Other software · Master-quiz Project · reported by MITREMedium 6.5
An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
- Product
- Master-quiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3.CVE-2022-47406 · Other software · Change Password For Frontend Users Project · reported by MITREMedium 5.4
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
- Product
- Change Password For Frontend Users
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23504 · Other software · TYPO3 · reported by GitHubMedium 5.7
TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23503 · Other software · TYPO3 · reported by GitHubHigh 7.5
TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23502 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23501 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23500 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.CVE-2022-23499 · Other software · TYPO3 · reported by GitHubMedium 6.1
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (`script`, `style`, `noframes`, `noembed` and `iframe`) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.
- Product
- html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36108 · Other software · TYPO3 · reported by GitHubMedium 6.5
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36107 · Other software · TYPO3 · reported by GitHubMedium 6.5
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36106 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36105 · Other software · TYPO3 · reported by GitHubMedium 5.3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36104 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and valuesCVE-2022-36020 · Other software · TYPO3 · reported by GitHubMedium 6.1
The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.CVE-2022-35628 · Other software · In2code · reported by MITRECritical 9.8
A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.
- Product
- Living User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.CVE-2022-33157 · Other software · Libconnect Project · reported by MITREMedium 6.1
The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.
- Product
- Libconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.CVE-2022-33156 · Other software · Matomo · reported by MITREMedium 6.1
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
- Product
- Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The gridelements (aka Grid Elements) extension through 7.6.1, 8.x through 8.7.0, 9.x through 9.7.0, and 10.x through 10.2.0 extension for TYPO3 allows XSS.CVE-2022-29602 · Other software · Grid Elements Project · reported by MITREMedium 5.4
The gridelements (aka Grid Elements) extension through 7.6.1, 8.x through 8.7.0, 9.x through 9.7.0, and 10.x through 10.2.0 extension for TYPO3 allows XSS.
- Product
- Grid Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allowsCVE-2022-33155 · Other software · Ameos Tarteaucitron Project · reported by MITREMedium 5.4
The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allows XSS.
- Product
- Ameos Tarteaucitron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.CVE-2022-33154 · Other software · Schema Project · reported by MITREMedium 5.4
The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.
- Product
- Schema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The seminars (aka Seminar Manager) extension through 4.1.3 for TYPO3 allows SQL Injection.CVE-2022-29601 · Other software · Oliverklee · reported by MITRECritical 9.8
The seminars (aka Seminar Manager) extension through 4.1.3 for TYPO3 allows SQL Injection.
- Product
- Seminars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022The oelib (aka One is Enough Library) extension through 4.1.5 for TYPO3 allows SQL Injection.CVE-2022-29600 · Other software · Oliverklee · reported by MITRECritical 9.8
The oelib (aka One is Enough Library) extension through 4.1.5 for TYPO3 allows SQL Injection.
- Product
- Oelib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31050 · Other software · TYPO3 · reported by GitHubMedium 6
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31049 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31048 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31047 · Other software · TYPO3 · reported by GitHubMedium 5.3
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022TYPO3 is an open source web content management system.CVE-2022-31046 · Other software · TYPO3 · reported by GitHubMedium 4.3
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3.CVE-2022-24980 · Other software · Kitodo · reported by MITREHigh 7.5
An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.
- Product
- Kitodo.presentation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3.CVE-2022-24979 · Other software · Mittwald · reported by MITREMedium 5.3
An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer component does not include an access check. This allows an unauthenticated user to render various content elements, resulting in insecure direct object reference (IDOR), with the potential of exposing internal content elements.
- Product
- Varnishcache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3.CVE-2021-43564 · Other software · JOB Fair Project · reported by MITREHigh 7.5
An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).
- Product
- JOB Fair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3.CVE-2021-43563 · Other software · Pixxio · reported by MITREHigh 8.8
An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to download various media files from the DAM system.
- Product
- Pixx.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3.CVE-2021-43562 · Other software · Pixxio · reported by MITREHigh 8.8
An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it to a user-controlled filename, which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this.
- Product
- Pixx.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3.CVE-2021-43561 · Other software · Pega-sus · reported by MITREMedium 5.4
An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
- Product
- Google For Jobs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-41114 · Other software · TYPO3 · reported by GitHubMedium 4.8
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-41113 · Other software · TYPO3 · reported by GitHubHigh 8.8
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as described in TYPO3-CORE-SA-2020-006 (CVE-2020-11069). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system. To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time. The following Same-Site cookie settings in $GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite] are required for an attack to be successful: SameSite=strict: malicious evil.example.org invoking TYPO3 application at good.example.org and SameSite=lax or none: malicious evil.com invoking TYPO3 application at example.org. Update your instance to TYPO3 version 11.5.0 which addresses the problem described.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transienCVE-2021-38623 · Other software · Deferred Image Processing Project · reported by MITREHigh 7.5
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
- Product
- Deferred Image Processing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.CVE-2021-38302 · Other software · Newsletter Project · reported by MITRECritical 9.8
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
- Product
- Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a sessiCVE-2021-36793 · Other software · Routes Project · reported by MITREHigh 7.5
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
- Product
- Routes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.CVE-2021-36792 · Other software · Dated News Project · reported by MITREHigh 7.2
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.CVE-2021-36791 · Other software · Dated News Project · reported by MITREMedium 5.3
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.CVE-2021-36790 · Other software · Dated News Project · reported by MITREMedium 6.1
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.CVE-2021-36789 · Other software · Dated News Project · reported by MITRECritical 9.8
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.CVE-2021-36788 · Other software · Yoast · reported by MITREMedium 5.4
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.
- Product
- Yoast SEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.CVE-2021-36787 · Other software · In2code · reported by MITREMedium 5.4
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
- Product
- Femanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 13, 2021The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.CVE-2021-36786 · Other software · Miniorange · reported by MITREHigh 7.5
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
- Product
- Saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.CVE-2021-36785 · Other software · Miniorange · reported by MITREMedium 5.4
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.
- Product
- Saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.