CVSS: 3.5EPSS: 0%CPEs: 37EXPL: 0CVE-2012-1606
https://notcve.org/view.php?id=CVE-2012-1606
Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el componente Backend en TYPO3 v4.4.0 hasta v4.4.13, v4.5.0 hasta v4.5.13, v4.6.0 hasta v4.6.6, v4.7, v6.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados • http://osvdb.org/80760 http://secunia.com/advisories/48622 http://secunia.com/advisories/48647 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 http://www.debian.org/security/2012/dsa-2445 http://www.openwall.com/lists/oss-security/2012/03/30/4 http://www.securityfocus.com/bid/52771 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 40EXPL: 0CVE-2012-1607
https://notcve.org/view.php?id=CVE-2012-1607
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request. La secuencia de comandos Command Line Interface (CLI) en TYPO3 v4.4.0 hasta v4.4.13, v4.5.0 hasta v4.5.13, v4.6.0 hasta v4.6.6, v4.7, v6.0, permite a atacantes remotos obtener el nombre de una base de datos a través de una petición directa • http://osvdb.org/80761 http://secunia.com/advisories/48622 http://secunia.com/advisories/48647 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 http://www.debian.org/security/2012/dsa-2445 http://www.openwall.com/lists/oss-security/2012/03/30/4 http://www.securityfocus.com/bid/52771 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 37EXPL: 0CVE-2012-1608
https://notcve.org/view.php?id=CVE-2012-1608
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters. El t3lib_div::RemoveXSS API método en TYPO3 v4.4.0 a través de v4.4.13, v4.5.0 a través de v4.5.13, v4.6.0 a través de v4.6.6, 4.7, y 6.0, permite a atacantes remotos evitar la ejecución de comandos en sitios cruzados (XSS) mecanismo de protección e inyectar secuencias de comandos web o HTML a través de caracteres no imprimibles. • http://secunia.com/advisories/48647 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 http://www.debian.org/security/2012/dsa-2445 http://www.openwall.com/lists/oss-security/2012/03/30/4 http://www.osvdb.org/80762 http://www.securityfocus.com/bid/52771 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 5%CPEs: 11EXPL: 1CVE-2011-4614 – Typo3 4.5 < 4.7 - Remote Code Execution / Local File Inclusion / Remote File Inclusion
https://notcve.org/view.php?id=CVE-2011-4614
PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACK_PATH parameter. Vulnerabilidad de inclusión remota de archivo PHP en Classes/Controller/AbstractController.php en la extensión del sistema de espacios de trabajo de TYPO3 v4.5.x antes de v4.5.9, v4.6.x antes de v4.6.2 y versiones de desarrollo de v4.7 permite a atacantes remotos ejecutar código PHP de su elección a través de una URL en el parámetro BACK_PATH. • https://www.exploit-db.com/exploits/18308 http://secunia.com/advisories/47201 http://typo3.org/fileadmin/security-team/bug32571/32571.diff http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004 http://www.openwall.com/lists/oss-security/2011/12/16/1 http://www.osvdb.org/77776 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.9EPSS: 0%CPEs: 26EXPL: 0CVE-2010-4068
https://notcve.org/view.php?id=CVE-2010-4068
Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administrators to read and possibly modify arbitrary files via a crafted parameter, a different vulnerability than CVE-2010-3714. Vulnerabilidad no especificada en Extension Manager en TYPO3 v4.2.x anteriores a v4.2.15, v4.3.x anteriores a v4.3.7, y v4.4.x anteriores a v4.4.4 permite a administradores remotos autenticados leer y posiblemente modificar ficheros de su elección a través de parámetros manipulados, es una vulnerabilidad distinta a CVE-2010-3714. • http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020 http://www.debian.org/security/2010/dsa-2121 http://www.securityfocus.com/bid/43786 • CWE-20: Improper Input Validation •