CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-55891 – Information Disclosure via Exception Handling/Logger in TYPO3
https://notcve.org/view.php?id=CVE-2024-55891
14 Jan 2025 — TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the problem described. There are no known workarounds for this vulnerability. • https://github.com/TYPO3/typo3/security/advisories/GHSA-38x7-cc6w-j27q • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-23501 – TYPO3 vulnerable to Improper Authentication in Frontend Login
https://notcve.org/view.php?id=CVE-2022-23501
14 Dec 2022 — TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.3... • https://github.com/TYPO3/typo3/security/advisories/GHSA-jfp7-79g7-89rf • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 2CVE-2021-21365 – Cross-Site Scripting in Content Rendering
https://notcve.org/view.php?id=CVE-2021-21365
27 Apr 2021 — Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custom code must manually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described. • https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2019-19849
https://notcve.org/view.php?id=CVE-2019-19849
17 Dec 2019 — An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited... • https://review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:security • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19848
https://notcve.org/view.php?id=CVE-2019-19848
17 Dec 2019 — An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.) Se descubrió un problema en TYPO3 versiones anteriores a la versión 8.7.30, versiones 9.x anteriores a la versión 9.5.12 y versiones 10.x anteri... • https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2010-3674
https://notcve.org/view.php?id=CVE-2010-3674
05 Nov 2019 — TYPO3 before 4.4.1 allows XSS in the frontend search box. TYPO3 versiones anteriores a la versión 4.4.1, permite un ataque de tipo XSS en el cuadro de búsqueda de la interfaz. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2010-3672
https://notcve.org/view.php?id=CVE-2010-3672
05 Nov 2019 — TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension. TYPO3 versiones anteriores a la versión 4.3.4 y versiones 4.4.x anteriores a la versión 4.4.1, permite un ataque de tipo XSS en el asistente de vista de área de texto en una extensión extbase. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.4EPSS: 0%CPEs: 4EXPL: 0CVE-2010-3671
https://notcve.org/view.php?id=CVE-2010-3671
05 Nov 2019 — TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session. TYPO3 versiones anteriores a la versión 4.1.14, versiones 4.2.x anteriores a la versión 4.2.13, versiones 4.3.x anteriores a la versión 4.3.4 y versiones 4.4.x anteriores a la versión 4.4.1, está abierto a un ataque de fijación de sesión lo que permite a atacantes remotos secuestrar la sesión de una víctima. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 • CWE-384: Session Fixation •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2010-3670
https://notcve.org/view.php?id=CVE-2010-3670
05 Nov 2019 — TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function. TYPO3 versiones anteriores a la versión 4.3.4 y versiones 4.4.x anteriores a 4.4.1, contiene una aleatoriedad no segura durante la generación de un hash con la función "forgot password". • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 • CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2010-3668
https://notcve.org/view.php?id=CVE-2010-3668
04 Nov 2019 — TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature jumpurl. TYPO3 versiones anteriores a la versión 4.1.14, versiones 4.2.x anteriores a la versión 4.2.13, versiones 4.3.x anteriores a la versión 4.3.4 y versiones 4.4.x anteriores a la versión 4.4.1, permite una Inyección de Encabezado en la funcionalidad de descarga segura jumpurl. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •