Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
730 results · page 5 of 15
Aug 10, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-32768 · Other software · TYPO3 · reported by GitHubMedium 6.1
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32767 · Other software · TYPO3 · reported by GitHubMedium 5.3
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32669 · Other software · TYPO3 · reported by GitHubMedium 6.4
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this vulnerability.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32668 · Other software · TYPO3 · reported by GitHubMedium 6.4
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-32667 · Other software · TYPO3 · reported by GitHubMedium 6.4
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.CVE-2021-31779 · Other software · Yoast · reported by MITREMedium 6.4
The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
- Product
- Yoast SEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.CVE-2021-31778 · Other software · Media2click Project · reported by MITREMedium 5.4
The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
- Product
- Media2click
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user accoCVE-2021-31777 · Other software · Dynamic Content Elements Project · reported by MITREMedium 4.9
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
- Product
- Dynamic Content Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcds.thalesgroup.com
Apr 27, 2021Bootstrap Package is a theme for TYPO3.CVE-2021-21365 · Other software · benjaminkott · reported by GitHubMedium 5.4
Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custom code must manually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described. Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/.
- Product
- bootstrap_package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21370 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21359 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21358 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21357 · Other software · TYPO3 · reported by GitHubHigh 8.3
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21355 · Other software · TYPO3 · reported by GitHubHigh 8.6
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, _UploadedFileReferenceConverter_ transforming uploaded files into proper FileReference domain model objects handles possible file uploads for other extensions as well - given those extensions use the Extbase MVC framework, make use of FileReference items in their direct or inherited domain model definitions and did not implement their own type converter. In case this scenario applies, _UploadedFileReferenceConverter_ accepts any file mime-type and persists files in the default location. In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exp
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21340 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1 .
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21339 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 22, 2021TYPO3 is an open source PHP based web content management system.CVE-2021-21338 · Other software · TYPO3 · reported by GitHubMedium 4.7
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compackagist.org
Mar 16, 2021The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.CVE-2021-28381 · Other software · VHS Project · reported by MITRECritical 9.8
The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.
- Product
- VHS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2021The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.CVE-2021-28380 · Other software · Aimeos Project · reported by MITREMedium 5.4
The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.
- Product
- Aimeos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2020TYPO3 is an open source PHP based web content management system.CVE-2020-26229 · Other software · TYPO3 · reported by GitHubLow 3.7
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2020TYPO3 is an open source PHP based web content management system.CVE-2020-26228 · Other software · TYPO3 · reported by GitHubHigh 8.1
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2020TYPO3 is an open source PHP based web content management system.CVE-2020-26227 · Other software · TYPO3 · reported by GitHubMedium 6.1
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.
- Product
- TYPO3.CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2020An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3.CVE-2020-28917 · Other software · View Frontend Statistics Project · reported by MITREMedium 6.5
An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.
- Product
- View Frontend Statistics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.CVE-2020-26216 · Other software · TYPO3 · reported by GitHubHigh 8
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory.
- Product
- Fluid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2020TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when makCVE-2020-15241 · Other software · TYPO3 · reported by GitHubMedium 4.7
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).
- Product
- Fluid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, CVE-2020-25026 · Other software · Derhansen · reported by MITREMedium 4.3
The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
- Product
- Event Management And Registration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fielCVE-2020-25025 · Other software · Localization Manager Project · reported by MITREMedium 4.3
The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
- Product
- Localization Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2020In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages CVE-2020-15099 · Other software · TYPO3 · reported by GitHubHigh 8.1
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php, which again contains the encryptionKey as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network, this allows the ability to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. This has been patched in versions 9.5.20 and 10.4.6.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2020In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an interCVE-2020-15098 · Other software · TYPO3 · reported by GitHubHigh 8.8
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2020In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism CVE-2020-15086 · Other software · FriendsOfTYPO3 · reported by GitHubCritical 9.8
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3.
- Product
- mediace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2020The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.CVE-2020-16095 · Other software · Kitodo · reported by MITREMedium 6.1
The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.
- Product
- Kitodo.presentation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2020The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.CVE-2020-15515 · Other software · Turn! Project · reported by MITREHigh 8.8
The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.
- Product
- Turn!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2020The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.CVE-2020-15517 · Other software · Faceted Search Project · reported by MITREMedium 5.4
The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.
- Product
- Faceted Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2020The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.CVE-2020-15516 · Other software · MM Forum Project · reported by MITREMedium 5.4
The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.
- Product
- MM Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2020The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.CVE-2020-15514 · Other software · JH Captcha Project · reported by MITREMedium 5.4
The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.
- Product
- JH Captcha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2020The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.CVE-2020-15513 · Other software · Mittwald · reported by MITREMedium 5.3
The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.
- Product
- Typo3 Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-siCVE-2020-11069 · Other software · TYPO3 · reported by GitHubHigh 8
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server. Scripts are then executed with the privileges of the victims' user session. In a worst-case scenario, new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it's actually a same-site request forgery. Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a third party extension, e.g. file upload in a contact form with knowing the target location. To be successful, the attacked victim requires an active and valid backend or install tool user session at the time of the attack. This has been fixed in 9.5.17 and 10.4.2. The deployment of additional mitigation techniques is suggested as described below.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deseCVE-2020-11067 · Other software · TYPO3 · reported by GitHubHigh 8.8
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious usCVE-2020-11066 · Other software · TYPO3 · reported by GitHubHigh 8.7
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically-determined object attributes and result in triggering deletion of an arbitrary directory in the file system, if it is writable for the web server. It can also trigger message submission via email using the identity of the web site (mail relay). Another insecure deserialization vulnerability is required to actually exploit mentioned aspects. This has been fixed in 9.5.17 and 10.4.2.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link taCVE-2020-11065 · Other software · TYPO3 · reported by GitHubMedium 5.4
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placCVE-2020-11064 · Other software · TYPO3 · reported by GitHubMedium 5.4
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users.CVE-2020-11063 · Other software · TYPO3 · reported by GitHubLow 3.7
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3.CVE-2020-11070 · Other software · TYPO3GmbH · reported by GitHubMedium 5.4
The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.
- Product
- svg_sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.CVE-2020-12700 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.CVE-2020-12699 · Other software · DKD · reported by MITREMedium 6.1
The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.CVE-2020-12698 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.CVE-2020-12697 · Other software · DKD · reported by MITREMedium 5.3
The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2020Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remoCVE-2011-3642 · Other software · Flowplayer · reported by MITRECritical 9.6
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.
- Product
- Flowplayer Flash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2020The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation envirCVE-2014-8328 · Other software · Dynamic Content Elements Project · reported by MITREMedium 5.3
The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request.
- Product
- Dynamic Content Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2020svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a tarCVE-2020-8091 · Other software · Typo3 · reported by MITREMedium 6.1
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgpurplemet.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.