Page 4 of 23 results (0.004 seconds)

CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0

CVE-2013-4321

https://notcve.org/view.php?id=CVE-2013-4321

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250. File Abstraction Layer (FAL) en TYPO3 6.0.x anterior a 6.0.8 y 6.1.x anterior a 6.1.4 permite a editores remotos autenticados ejecutar código PHP arbitrario a través de caracteres no especificados en la extensión de archivo cuando renombran un archivo. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2013-4250. • https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 2.6EPSS: 0%CPEs: 70EXPL: 0

CVE-2013-7078

https://notcve.org/view.php?id=CVE-2013-7078

Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message. NOTE: this might be the same vulnerability as CVE-2013-7072. Cross-site scripting (XSS) en el método errorAction en la clase base ActionController en el Framwork Extbase en TYPO3 4.5.0 hasta  4.5.31, 4.7.0 hasta  4.7.16, 6.0.0 hasta 6.0.11 y 6.1.0 hasta 6.1.6, cuando la propiedad Rewritten Mapper está activada, que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una entrada no especificada, que se traduce en un mensaje de error. NOTA: esta podría ser la misma vulnerabilidad CVE-2.013-7.072. • http://osvdb.org/100885 http://seclists.org/oss-sec/2013/q4/473 http://seclists.org/oss-sec/2013/q4/487 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 http://www.securityfocus.com/bid/64239 https://exchange.xforce.ibmcloud.com/vulnerabilities/89629 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 68EXPL: 0

CVE-2013-7075

https://notcve.org/view.php?id=CVE-2013-7075

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature." El componente Content Editing Wizards para TYPO3 v4.5.0 hasta v4.5.31, v4.7.0 hasta v4.7.16, v6.0.0 hasta v6.0.11, y v6.1.0 hasta v6.1.6 permite a usuarios del backend autenticados desserializar objetos PHP, eliminar cualquier fichero, y posiblemente tener otros impactos no especificados a través de un parámetro sin especificar, relacionado con una "falta de firma". • http://seclists.org/oss-sec/2013/q4/473 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 http://www.debian.org/security/2014/dsa-2834 • CWE-310: Cryptographic Issues •

CVSS: 5.8EPSS: 0%CPEs: 68EXPL: 0

CVE-2013-7079

https://notcve.org/view.php?id=CVE-2013-7079

Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Vulnerabilidad de redirección abierta en la extensión de OpenID en TYPO3 4.5.0 a 4.5.31, 4.7.0 a 4.7.16, 6.0.0 a 6.0.11, y 6.1.0 a 6.1.6 permite a atacantes remotos redireccionar usuarios a sitios web arbitrarios y efectuar ataques de phishing a través de vectores no especificados. • http://seclists.org/oss-sec/2013/q4/473 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 http://www.debian.org/security/2014/dsa-2834 http://www.securityfocus.com/bid/64252 • CWE-20: Improper Input Validation •

CVSS: 4.0EPSS: 0%CPEs: 68EXPL: 0

CVE-2013-7073

https://notcve.org/view.php?id=CVE-2013-7073

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters. El componente Content Editing Wizards para TYPO3 v4.5.0 hasta v4.5.31, v4.7.0 hasta v4.7.16, v6.0.0 hasta v6.0.11, y v6.1.0 hasta v6.1.6 no comprueba los permisos, lo que permite a los editores remotos autenticados leer columnas de tablas de TYPO3 arbitrarias a través de parámetros no especificados. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html http://seclists.org/oss-sec/2013/q4/473 http://seclists.org/oss-sec/2013/q4/487 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 http://www.debian.org/security/2014/dsa-2834 • CWE-264: Permissions, Privileges, and Access Controls •