CVSS: 5.1EPSS: 1%CPEs: 1EXPL: 0CVE-2010-0286
https://notcve.org/view.php?id=CVE-2010-0286
Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities during authentication. Vulnerabilidad no especificada en la extensión OpenID Identity Authentication para TYPO3 v4.3.0 permite a atacantes remotos saltarse la autenticación y ganar acceso a una cuenta de usuario de la consola de administración a través de vectores de ataque desconocidos en el caso que ambos, atacante y víctima tengan una proveedor OpenID que deseche las identidades durante la autenticación. • http://osvdb.org/61680 http://secunia.com/advisories/38206 http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-001 http://www.vupen.com/english/advisories/2010/0127 https://exchange.xforce.ibmcloud.com/vulnerabilities/55609 •
CVSS: 4.0EPSS: 0%CPEs: 59EXPL: 0CVE-2009-3628
https://notcve.org/view.php?id=CVE-2009-3628
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to determine an encryption key via crafted input to a tt_content form element. El subcomponente Backend de TYPO3 v4.0.13 y anteriores, v4.1.x anteriores a v4.1.13, v4.2.x anteriores a v4.2.10 y v4.3.x anteriores a v4.3beta2 permite a atacantes remotos autenticados determinar la clave de encriptación a través de una entrada modificada al elemento de formulario tt_content. • http://marc.info/?l=oss-security&m=125632856206736&w=2 http://secunia.com/advisories/37122 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016 http://www.securityfocus.com/bid/36801 http://www.vupen.com/english/advisories/2009/3009 https://exchange.xforce.ibmcloud.com/vulnerabilities/53917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 46EXPL: 0CVE-2009-3629
https://notcve.org/view.php?id=CVE-2009-3629
Multiple cross-site scripting (XSS) vulnerabilities in the Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el subcomponente Backend de TYPO3 v4.0.13 y anteriores, v4.1.x anteriores a v4.1.13, v4.2.x anteriores a v4.2.10 y v4.3.x anteriores a v4.3beta2. Permiten a usuarios remotos autenticados inyectar codigo de script web o código HTML a través de vectores de ataque sin especificar. • http://marc.info/?l=oss-security&m=125632856206736&w=2 http://marc.info/?l=oss-security&m=125633199111438&w=2 http://secunia.com/advisories/37122 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016 http://www.securityfocus.com/bid/36801 http://www.vupen.com/english/advisories/2009/3009 https://exchange.xforce.ibmcloud.com/vulnerabilities/53918 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 59EXPL: 0CVE-2009-3630
https://notcve.org/view.php?id=CVE-2009-3630
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to place arbitrary web sites in TYPO3 backend framesets via crafted parameters, related to a "frame hijacking" issue. El subcomponente Backend de TYPO3 v4.0.13 y anteriores, v4.1.x anteriores a v4.1.13, v4.2.x anteriores a v4.2.10 y v4.3.x anteriores a v4.3beta2 permite a usuarios autenticados remotos situar sitios web de su elección en los "framesets" (conjuntos de marcos) de backend a través de parámetros modificados, relacionado con un asunto de "frame hijacking" (secuestro de marco). • http://marc.info/?l=oss-security&m=125632856206736&w=2 http://secunia.com/advisories/37122 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016 http://www.securityfocus.com/bid/36801 http://www.vupen.com/english/advisories/2009/3009 https://exchange.xforce.ibmcloud.com/vulnerabilities/53920 •
CVSS: 8.5EPSS: 0%CPEs: 59EXPL: 0CVE-2009-3631
https://notcve.org/view.php?id=CVE-2009-3631
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM extension or ftp upload is enabled, allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename. El subcomponente Backend de TYPO3 v4.0.13 y anteriores, v4.1.x anteriores a v4.1.13, v4.2.x anteriores a v4.2.10 y v4.3.x anteriores a v4.3beta2, cuando la extensión DAM o la subida por ftp está activada, permite a usuarios autenticados remotos ejecutar comandos de su elección a través metacaracteres de shell en un nombre de fichero. • http://marc.info/?l=oss-security&m=125632856206736&w=2 http://secunia.com/advisories/37122 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016 http://www.securityfocus.com/bid/36801 http://www.vupen.com/english/advisories/2009/3009 https://exchange.xforce.ibmcloud.com/vulnerabilities/53923 • CWE-94: Improper Control of Generation of Code ('Code Injection') •