Search for packages
| purl | pkg:composer/typo3/cms@4.6.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-57cn-dmzh-4kdq
Aliases: CVE-2012-2112 GHSA-qfr3-29w6-hwpg |
Typo3 Exception Handler XSS Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages. |
Affected by 0 other vulnerabilities. |
|
VCID-88ng-ph1q-cybw
Aliases: CVE-2012-1608 GHSA-w3v6-r62r-fvqh |
Improper Input Validation The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters. |
Affected by 0 other vulnerabilities. |
|
VCID-8fcj-b2dq-3qav
Aliases: CVE-2012-6146 GHSA-2hp4-8h6h-93rr |
Typo3 Backend History Module Vulnerable to XSS The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-99uu-rfrf-bqa7
Aliases: CVE-2014-9508 GHSA-v6xv-rmqc-wcc8 |
Typo3 Open Redirect In Frontend Rendering The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option `config.prefixLocalAnchors` is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri. Installations where `config.absRefPrefix` is additionally set to any value are not affected by this vulnerability. Example of affected configuration: ```php config.absRefPrefix = config.prefixLocalAnchors = all page = PAGE page.10 = TEXT page.10.value = <a href="#skiplinks">Skiplinks</a> .htaccess: RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-l RewriteRule .* index.php [L] ``` |
Affected by 95 other vulnerabilities. Affected by 61 other vulnerabilities. |
|
VCID-b7s9-hkwv-63ht
Aliases: CVE-2012-3530 GHSA-94c2-g68f-9r98 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Incomplete block list vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-dban-xxn2-f3b2
Aliases: CVE-2012-6144 GHSA-947m-vgqc-x6v4 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-fprf-zjud-8fcv
Aliases: CVE-2012-1606 GHSA-7wwr-p84q-qr3q |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. |
|
VCID-fv74-gq28-rkd5
Aliases: CVE-2012-1605 GHSA-7jfm-px59-99w8 |
Typo3 Extbase Framework Unsafe Deserialization The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument." |
Affected by 0 other vulnerabilities. |
|
VCID-g75m-m11u-7fbj
Aliases: CVE-2012-3531 GHSA-p9wg-jvj4-cx26 |
Typo3 Install Tool XSS Vulnerability Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-jb2j-eygc-n7b7
Aliases: CVE-2012-6148 GHSA-rgf6-9q7g-55qg |
Typo3 Function Menu API XSS Vulnerability Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-v3xx-f132-g3hn
Aliases: CVE-2012-3529 GHSA-7gg8-3r6j-5g55 |
Typo3 Backend Configuration XSS Vulnerability The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-vbbx-pk8m-jfhd
Aliases: CVE-2014-9509 GHSA-5479-gqqr-f9gj |
Typo3 Vulnerable to Cache Poisoning **Problem Description:** A request URL with arbitrary arguments, but still pointing to the home page of a TYPO3 installation can be cached if the configuration option `config.prefixLocalAnchors` is used with the values "all" or "cached". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. **Solution:** Removing the configuration options `config.prefixLocalAnchors` (and optionally also config.baseUrl) in favor of `config.absRefPrefix` **Credits:** Thanks to Gernot Leitgab who discovered and reported the vulnerability. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 95 other vulnerabilities. Affected by 61 other vulnerabilities. |
|
VCID-xns2-f7um-qqgn
Aliases: CVE-2012-6147 GHSA-qmmw-ch2q-j6xx |
Typo3 Backend API XSS Vulnerability Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-y6zm-rwrr-m3ah
Aliases: CVE-2012-6145 GHSA-w563-rq37-cvq5 |
Typo3 Backend History Module Vulnerable to XSS Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-yk4b-baue-rkbt
Aliases: CVE-2012-1607 GHSA-q68v-vcjg-r3vp |
TYPO3 allows remote attackers to obtain the database name via a direct request The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request. | There are no reported fixed by versions. |
|
VCID-yytp-t23g-wkc8
Aliases: CVE-2012-3527 GHSA-m4hw-r893-xh4g |
TYPO3 allows remote authenticated backend users to unserialize arbitrary objects view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)." |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-zbvd-rppy-gyab
Aliases: CVE-2012-3528 GHSA-7w6c-5pr4-7qvp |
Typo3 Backend XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||