CVSS: 4.0EPSS: 0%CPEs: 6EXPL: 0CVE-2014-3946
https://notcve.org/view.php?id=CVE-2014-3946
The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors. La funcionalidad de cacheo de consulta en el componente Extbase Framework en TYPO3 6.2.0 anterior a 6.2.3 no valida debidamente permisos de grupo, lo que permite a usuarios remotos autenticados leer consultas arbitrarias a través de vectores no especificados. • http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 http://www.debian.org/security/2014/dsa-2942 http://www.openwall.com/lists/oss-security/2014/06/03/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 82EXPL: 0CVE-2014-3943
https://notcve.org/view.php?id=CVE-2014-3943
Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters. Múltiples vulnerabilidades de XSS en componentes de motor (backend) no especificados en TYPO3 4.5.0 anterior a 4.5.34, 4.7.0 anterior a 4.7.19, 6.0.0 anterior a 6.0.14, 6.1.0 anterior a 6.1.9 y 6.2.0 anterior a 6.2.3 permiten a editores remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de parámetros desconocidos. • http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 http://www.debian.org/security/2014/dsa-2942 http://www.openwall.com/lists/oss-security/2014/06/03/2 http://www.securityfocus.com/bid/67625 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0CVE-2014-3944
https://notcve.org/view.php?id=CVE-2014-3944
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors. El componente de autenticación en TYPO3 6.2.0 anterior a 6.2.3 no invalida debidamente sesiones de usuario fuera de tiempo, lo que permite a atacantes remotos evadir autenticación a través de vectores no especificados. • http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 http://www.debian.org/security/2014/dsa-2942 http://www.openwall.com/lists/oss-security/2014/06/03/2 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 82EXPL: 0CVE-2014-3941
https://notcve.org/view.php?id=CVE-2014-3941
TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing." TYPO3 4.5.0 anterior a 4.5.34, 4.7.0 anterior a 4.7.19, 6.0.0 anterior a 6.0.14, 6.1.0 anterior a 6.1.9 y 6.2.0 anterior a 6.2.3 permite a atacantes remotos tener impacto no especificado a través de una cabecera de anfitrión HTTP manipulada, relacionado con 'falsificación de anfitrión.' • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 http://www.debian.org/security/2014/dsa-2942 http://www.openwall.com/lists/oss-security/2014/06/03/2 • CWE-20: Improper Input Validation •
CVSS: 3.5EPSS: 0%CPEs: 71EXPL: 0CVE-2013-7074
https://notcve.org/view.php?id=CVE-2013-7074
Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters. Múltiples vulnerabilidades de cross-site scripting (XSS) en Content Editing Wizards en TYPO3 4.5.x anteriores a 4.5.32, 4.7.x anteriores a 4.7.17, 6.0.x anteriores a 6.0.12, 6.1.x anteriores a 6.1.7, y las versiones de desarrollo 6.2, permite a usuarios autenticados remotamente inyectar scripts web o HTML arbitrarios a través de parámetros no especificados. • http://osvdb.org/100881 http://seclists.org/oss-sec/2013/q4/473 http://seclists.org/oss-sec/2013/q4/487 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 http://www.debian.org/security/2014/dsa-2834 http://www.securityfocus.com/bid/64245 https://exchange.xforce.ibmcloud.com/vulnerabilities/89620 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •