CVSS: 6.5EPSS: 0%CPEs: 46EXPL: 0CVE-2009-3632
https://notcve.org/view.php?id=CVE-2009-3632
SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters. Vulnerabilidad de inyección SQL en la funcionalidad de edición del "frontend" (portal de usuario) tradicional del subcomponente "Frontend Editing" (edición del portal de usuario) de TYPO3 v4.0.13 y anteriores, v4.1.x anteriores a v4.1.13, v4.2.x anteriores a v4.2.10 y v4.3.x anteriores a v4.3beta2. Permite a usuarios remotos ejecutar comandos SQL de su elección a través parámetros sin especificar. • http://marc.info/?l=oss-security&m=125632856206736&w=2 http://secunia.com/advisories/37122 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016 http://www.securityfocus.com/bid/36801 http://www.vupen.com/english/advisories/2009/3009 https://exchange.xforce.ibmcloud.com/vulnerabilities/53924 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.0EPSS: 0%CPEs: 59EXPL: 0CVE-2009-3628
https://notcve.org/view.php?id=CVE-2009-3628
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to determine an encryption key via crafted input to a tt_content form element. El subcomponente Backend de TYPO3 v4.0.13 y anteriores, v4.1.x anteriores a v4.1.13, v4.2.x anteriores a v4.2.10 y v4.3.x anteriores a v4.3beta2 permite a atacantes remotos autenticados determinar la clave de encriptación a través de una entrada modificada al elemento de formulario tt_content. • http://marc.info/?l=oss-security&m=125632856206736&w=2 http://secunia.com/advisories/37122 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016 http://www.securityfocus.com/bid/36801 http://www.vupen.com/english/advisories/2009/3009 https://exchange.xforce.ibmcloud.com/vulnerabilities/53917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2007-1081
https://notcve.org/view.php?id=CVE-2007-1081
The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information. La función start en class.t3lib_formmail.php en TYPO3 anterior a 4.0.5, 4.1beta, y 4.1RC1 permite a atacantes remotos inyectar cabeceras email de su elección a través de vectores desconocidos. NOTA: Algunos de estos detalles se obtuvieron de información de terceros. • http://osvdb.org/33471 http://secunia.com/advisories/24207 http://typo3.org/teams/security/security-bulletins/typo3-20070221-1 http://www.securityfocus.com/bid/22668 http://www.vupen.com/english/advisories/2007/0697 https://exchange.xforce.ibmcloud.com/vulnerabilities/32630 •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2006-5069
https://notcve.org/view.php?id=CVE-2006-5069
Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter. Vulnerabilidad de XSS en class.tx_indexedsearch.php en la extensión Indexed Search 2.9.0 para Typo3 en versiones anteriores a 4.0.2 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro de búsqueda. • http://marc.info/?l=full-disclosure&m=115918334930694&w=2 http://secunia.com/advisories/22071 http://securityreason.com/securityalert/1646 http://typo3.org/teams/security/security-bulletins/typo3-20060911-1 http://www.securityfocus.com/archive/1/446885/100/0/threaded http://www.securityfocus.com/bid/20173 http://www.vupen.com/english/advisories/2006/3782 https://exchange.xforce.ibmcloud.com/vulnerabilities/29128 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2005-4875
https://notcve.org/view.php?id=CVE-2005-4875
TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables. • http://bugs.typo3.org/view.php?id=1250 http://typo3.org/teams/security/security-bulletins/typo3-20050725-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/42457 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •