Search for packages
| purl | pkg:composer/typo3/cms@4.3.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4h31-swcq-suh9
Aliases: CVE-2010-3714 GHSA-w736-qv86-vq94 |
TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism The jumpUrl (aka access tracking) implementation in `tslib/class.tslib_fe.php` in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-fjtr-nupy-s3bm
Aliases: CVE-2010-1153 GHSA-4h9j-f98m-p4hg |
TYPO3 PHP remote file inclusion vulnerability PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable. |
Affected by 0 other vulnerabilities. |
|
VCID-fvcm-r3eg-cfdd
Aliases: CVE-2010-5101 GHSA-rmqc-wfjm-3f66 |
TYPO3 Directory Traversal vulnerability Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality." |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-r1et-gsp9-1bbp
Aliases: CVE-2010-5099 GHSA-66j3-66cp-6c2m |
TYPO3 Path Traversal vulnerability The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-v2e7-fwms-n3ag
Aliases: CVE-2010-5103 GHSA-r2w2-2r2x-fpcx |
TYPO3 SQL Injection vulnerability SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||