CVSS: 3.5EPSS: 0%CPEs: 33EXPL: 0CVE-2014-3949
https://notcve.org/view.php?id=CVE-2014-3949
Cross-site scripting (XSS) vulnerability in the layout wizard in the Grid Elements (gridelements) extension before 1.5.1 and 2.0.x before 2.0.3 for TYPO3 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en el asistente de diseño en la extensión Grid Elements (gridelements) anterior a 1.5.1 y 2.0.x anterior a 2.0.3 para TYPO3 permite a usuarios remotos autenticados de backend inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/58592 http://typo3.org/extensions/repository/view/gridelements http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-008 http://www.openwall.com/lists/oss-security/2014/06/03/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 186EXPL: 0CVE-2014-3945
https://notcve.org/view.php?id=CVE-2014-3945
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash. El componente de autenticación en TYPO3 anterior a 6.2, cuando la creación de salts para el hash de contraseñas está deshabilitado, no requiere conocimiento de la contraseña en texto claro si se conoce el hash de la contraseña, lo que permite a atacantes remotos evadir autenticación y ganar acceso al motor mediante el aprovechamiento de conocimiento de un hash de contraseña. • http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 http://www.debian.org/security/2014/dsa-2942 http://www.openwall.com/lists/oss-security/2014/06/03/2 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2013-5323
https://notcve.org/view.php?id=CVE-2013-5323
Cross-site scripting (XSS) vulnerability in the Static Info Tables (static_info_tables) extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad XSS en la extensión Static Info Tables (static_info_tables) anterior a 2.3.1 para TYPO3, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de vectores no especificados. • http://osvdb.org/90414 http://secunia.com/advisories/52283 http://typo3.org/extensions/repository/view/static_info_tables http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-004 http://www.securityfocus.com/bid/58056 https://exchange.xforce.ibmcloud.com/vulnerabilities/82212 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2013-5307
https://notcve.org/view.php?id=CVE-2013-5307
Cross-site scripting (XSS) vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-site scripting (XSS) en la extensión Faceted Search (ke_search) anterior a v1.4.1 para TYPO3, permite a atacantes remotos inyectar web scripts arbitrarios o HTML mediante vectores desconocidos • http://osvdb.org/95960 http://secunia.com/advisories/54306 http://typo3.org/extensions/repository/view/ke_search http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-013 http://www.securityfocus.com/bid/61609 https://exchange.xforce.ibmcloud.com/vulnerabilities/86236 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 19EXPL: 0CVE-2013-4745
https://notcve.org/view.php?id=CVE-2013-4745
SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la extensión My quiz and poll (myquizpoll) anterior a 2.0.6 para TYPO3, permite a atacantes remotos la ejecución arbitraria de comandos SQL a través de vectores no especificados. • http://osvdb.org/90410 http://typo3.org/extensions/repository/view/myquizpoll http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •