CVSS: 4.0EPSS: 0%CPEs: 186EXPL: 0CVE-2014-3945
https://notcve.org/view.php?id=CVE-2014-3945
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash. El componente de autenticación en TYPO3 anterior a 6.2, cuando la creación de salts para el hash de contraseñas está deshabilitado, no requiere conocimiento de la contraseña en texto claro si se conoce el hash de la contraseña, lo que permite a atacantes remotos evadir autenticación y ganar acceso al motor mediante el aprovechamiento de conocimiento de un hash de contraseña. • http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 http://www.debian.org/security/2014/dsa-2942 http://www.openwall.com/lists/oss-security/2014/06/03/2 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2013-5323
https://notcve.org/view.php?id=CVE-2013-5323
Cross-site scripting (XSS) vulnerability in the Static Info Tables (static_info_tables) extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad XSS en la extensión Static Info Tables (static_info_tables) anterior a 2.3.1 para TYPO3, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de vectores no especificados. • http://osvdb.org/90414 http://secunia.com/advisories/52283 http://typo3.org/extensions/repository/view/static_info_tables http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-004 http://www.securityfocus.com/bid/58056 https://exchange.xforce.ibmcloud.com/vulnerabilities/82212 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2013-5307
https://notcve.org/view.php?id=CVE-2013-5307
Cross-site scripting (XSS) vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-site scripting (XSS) en la extensión Faceted Search (ke_search) anterior a v1.4.1 para TYPO3, permite a atacantes remotos inyectar web scripts arbitrarios o HTML mediante vectores desconocidos • http://osvdb.org/95960 http://secunia.com/advisories/54306 http://typo3.org/extensions/repository/view/ke_search http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-013 http://www.securityfocus.com/bid/61609 https://exchange.xforce.ibmcloud.com/vulnerabilities/86236 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 11EXPL: 0CVE-2013-4680
https://notcve.org/view.php?id=CVE-2013-4680
Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Vulnerabilidad de inyección SQL en la extensión "Maag Form Captcha" v2.0.0 y anteriores para TYPO3 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://osvdb.org/93818 http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-007 http://www.securityfocus.com/bid/60298 https://exchange.xforce.ibmcloud.com/vulnerabilities/84670 •
CVSS: 4.3EPSS: 0%CPEs: 67EXPL: 0CVE-2012-5889
https://notcve.org/view.php?id=CVE-2012-5889
Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la extensión PowerMail antes de v1.6.5 para TYPO3 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-004 https://exchange.xforce.ibmcloud.com/vulnerabilities/74461 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •