Typo3 Cms vulnerabilities
115 known vulnerabilities affecting typo3/cms.
Total CVEs
115
CISA KEV
0
Public exploits
3
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH28MEDIUM72LOW11
Vulnerabilities
Page 3 of 6
CVE-2012-1605MEDIUM≥ 4.6, < 4.6.7≥ 4.4.0, < 4.4.14+1 more2022-05-17
CVE-2012-1605 [MEDIUM] CWE-502 Typo3 Extbase Framework Unsafe Deserialization
Typo3 Extbase Framework Unsafe Deserialization
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
ghsaosv
CVE-2012-3530MEDIUM≥ 4.5, < 4.5.19≥ 4.6, < 4.6.12+1 more2022-05-17
CVE-2012-3530 [MEDIUM] CWE-79 Typo3 API XSS Vulnerability
Typo3 API XSS Vulnerability
Incomplete blacklist vulnerability in the `t3lib_div::quoteJSvalue` API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
ghsaosv
CVE-2012-1608MEDIUM≥ 4.4.0, < 4.4.14≥ 4.5.0, < 4.5.14+1 more2022-05-17
CVE-2012-1608 [MEDIUM] CWE-20 Typo3 API XSS Vulnerabilities
Typo3 API XSS Vulnerabilities
The `t3lib_div::RemoveXSS` API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
ghsaosv
CVE-2013-4321MEDIUMCVSS 6.5≥ 6.0.0, < 6.0.9≥ 6.1.0, < 6.1.42022-05-17
CVE-2013-4321 [MEDIUM] CWE-94 TYPO3 vulnerable to remote authenticated arbitrary code execution
TYPO3 vulnerable to remote authenticated arbitrary code execution
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.
ghsaosv
CVE-2012-3531MEDIUM≥ 4.5, < 4.5.19≥ 4.6, < 4.6.12+1 more2022-05-17
CVE-2012-3531 [MEDIUM] CWE-79 Typo3 Install Tool XSS Vulnerability
Typo3 Install Tool XSS Vulnerability
Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
ghsaosv
CVE-2014-9508MEDIUM≥ 4.5.0, < 4.5.39≥ 4.6.0, < 6.2.9+1 more2022-05-17
CVE-2014-9508 [MEDIUM] CWE-59 Typo3 Open Redirect In Frontend Rendering
Typo3 Open Redirect In Frontend Rendering
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains.
An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option `config.prefixLocalAnchors
ghsaosv
CVE-2012-1607MEDIUM≥ 4.4.0, ≤ 4.4.13≥ 4.5.0, ≤ 4.5.13+1 more2022-05-17
CVE-2012-1607 [MEDIUM] CWE-200 TYPO3 allows remote attackers to obtain the database name via a direct request
TYPO3 allows remote attackers to obtain the database name via a direct request
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
ghsaosv
CVE-2014-3946MEDIUM≥ 6.2.0, < 6.2.32022-05-17
CVE-2014-3946 [MEDIUM] CWE-200 Typo3 Information Disclosure
Typo3 Information Disclosure
Failing to respect user groups of logged in users when caching queries, Extbase is susceptible to information disclosure. The query caching (introduced in Extbase 6.2) used to cache queries that query results for a specific user group were presented to a different group.
ghsaosv
CVE-2013-7073MEDIUM≥ 4.5.0, < 4.5.32≥ 4.7.0, < 4.7.17+2 more2022-05-17
CVE-2013-7073 [MEDIUM] CWE-200 TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component
TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
ghsaosv
CVE-2012-6144MEDIUM≥ 4.5.0, < 4.5.21≥ 4.6.0, < 4.6.14+1 more2022-05-17
CVE-2012-6144 [MEDIUM] CWE-89 Typo3 Backend History Module Vulnerable to SQL Injection
Typo3 Backend History Module Vulnerable to SQL Injection
SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.
ghsaosv
CVE-2014-3944MEDIUM≥ 6.2.0, < 6.2.32022-05-17
CVE-2014-3944 [MEDIUM] CWE-287 TYPO3 Improper Session Invalidation
TYPO3 Improper Session Invalidation
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
ghsaosv
CVE-2015-8759MEDIUM≥ 6.2.0, < 6.2.16≥ 7.0.0, < 7.6.12022-05-17
CVE-2015-8759 [MEDIUM] CWE-79 TYPO3 Cross-site Scripting vulnerability
TYPO3 Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.
ghsaosv
CVE-2015-8760MEDIUM≥ 6.2.0, < 6.2.162022-05-17
CVE-2015-8760 [MEDIUM] CWE-20 TYPO3 allows remote attackers to embed Flash videos from external domain
TYPO3 allows remote attackers to embed Flash videos from external domain
The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
ghsaosv
CVE-2013-7075MEDIUM≥ 4.5.0, < 4.5.32≥ 4.7.0, < 4.7.17+2 more2022-05-17
CVE-2013-7075 [MEDIUM] CWE-502 TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parame
ghsaosv
CVE-2012-3527MEDIUM≥ 4.5.0, < 4.5.19≥ 4.6.0, < 4.6.12+1 more2022-05-17
CVE-2012-3527 [MEDIUM] CWE-502 TYPO3 allows remote authenticated backend users to unserialize arbitrary objects
TYPO3 allows remote authenticated backend users to unserialize arbitrary objects
view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
ghsaosv
CVE-2012-6148LOW≥ 4.5.0, < 4.5.21≥ 4.6.0, < 4.6.14+1 more2022-05-17
CVE-2012-6148 [LOW] CWE-79 Typo3 Function Menu API XSS Vulnerability
Typo3 Function Menu API XSS Vulnerability
Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
ghsaosv
CVE-2012-6145LOW≥ 4.5.0, < 4.5.21≥ 4.6.0, < 4.6.14+1 more2022-05-17
CVE-2012-6145 [LOW] CWE-79 Typo3 Backend History Module Vulnerable to XSS
Typo3 Backend History Module Vulnerable to XSS
Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
ghsaosv
CVE-2012-3528LOW≥ 4.5, < 4.5.19≥ 4.6, < 4.6.12+1 more2022-05-17
CVE-2012-3528 [LOW] CWE-79 Typo3 Backend XSS Vulnerability
Typo3 Backend XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
ghsaosv
CVE-2012-1606LOW≥ 4.4.0, < 4.4.14≥ 4.5.0, < 4.5.14+1 more2022-05-17
CVE-2012-1606 [LOW] CWE-79 Typo3 Backend XSS Vulnerabilities
Typo3 Backend XSS Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
ghsaosv
CVE-2013-7074LOW≥ 4.5.0, < 4.5.32≥ 4.7.0, < 4.7.17+2 more2022-05-17
CVE-2013-7074 [LOW] CWE-79 TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component
TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component
Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified param
ghsaosv