CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2012-3530
https://notcve.org/view.php?id=CVE-2012-3530
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events. Vulnerabilidad de lista negra incompleta en la función t3lib_div::quoteJSvalue en TYPO3 v4.5.x anterior a v4.5.19, 4.6.x anterior a v4.6.12 y v4.7.x anterior a v4.7.4 permite a atacantes remotos llevar a cabo ataques de ejecución de secuencias de comandos en sitios cruzados a través de ciertos eventos de JavaScript HTML5. • http://osvdb.org/84772 http://secunia.com/advisories/50287 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004 http://www.debian.org/security/2012/dsa-2537 http://www.openwall.com/lists/oss-security/2012/08/22/8 https://exchange.xforce.ibmcloud.com/vulnerabilities/77794 •
CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2012-3531
https://notcve.org/view.php?id=CVE-2012-3531
Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el Install Tool en TYPO3 v4.5.x anterior a v4.5.19, v4.6.x anterior a v4.6.12 y v4.7.x anterior a v4.7.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante vectores desconocidos. • http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004 http://www.debian.org/security/2012/dsa-2537 http://www.openwall.com/lists/oss-security/2012/08/22/8 https://exchange.xforce.ibmcloud.com/vulnerabilities/78888 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 39EXPL: 0CVE-2012-2112
https://notcve.org/view.php?id=CVE-2012-2112
Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el controlador de excepciones en TYPO3 v4.4.x anterior a v4.4.15, v4.5.15 anterior a v4.5.x, v4.6.x anterior a v4.6.8, y v4.7, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de mensajes de excepción. • http://lists.typo3.org/pipermail/typo3-announce/2012/000241.html http://lists.typo3.org/pipermail/typo3-announce/2012/000242.html http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002 http://www.debian.org/security/2012/dsa-2455 http://www.openwall.com/lists/oss-security/2012/04/17/5 http://www.openwall.com/lists/oss-security/2012/04/18/1 http://www.securityfocus.com/bid/53047 https://exchange.xforce.ibmcloud.com/vulnerabilities/74920 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 37EXPL: 0CVE-2012-1606
https://notcve.org/view.php?id=CVE-2012-1606
Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el componente Backend en TYPO3 v4.4.0 hasta v4.4.13, v4.5.0 hasta v4.5.13, v4.6.0 hasta v4.6.6, v4.7, v6.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados • http://osvdb.org/80760 http://secunia.com/advisories/48622 http://secunia.com/advisories/48647 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 http://www.debian.org/security/2012/dsa-2445 http://www.openwall.com/lists/oss-security/2012/03/30/4 http://www.securityfocus.com/bid/52771 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 40EXPL: 0CVE-2012-1607
https://notcve.org/view.php?id=CVE-2012-1607
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request. La secuencia de comandos Command Line Interface (CLI) en TYPO3 v4.4.0 hasta v4.4.13, v4.5.0 hasta v4.5.13, v4.6.0 hasta v4.6.6, v4.7, v6.0, permite a atacantes remotos obtener el nombre de una base de datos a través de una petición directa • http://osvdb.org/80761 http://secunia.com/advisories/48622 http://secunia.com/advisories/48647 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 http://www.debian.org/security/2012/dsa-2445 http://www.openwall.com/lists/oss-security/2012/03/30/4 http://www.securityfocus.com/bid/52771 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •