Search for packages
| purl | pkg:composer/typo3/cms@4.6.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1grv-8mgr-ekfg
Aliases: CVE-2012-1607 GHSA-q68v-vcjg-r3vp |
TYPO3 allows remote attackers to obtain the database name via a direct request The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request. | There are no reported fixed by versions. |
|
VCID-1vvw-1p8y-8kd7
Aliases: CVE-2014-9509 GHSA-5479-gqqr-f9gj |
Typo3 Vulnerable to Cache Poisoning **Problem Description:** A request URL with arbitrary arguments, but still pointing to the home page of a TYPO3 installation can be cached if the configuration option `config.prefixLocalAnchors` is used with the values "all" or "cached". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. **Solution:** Removing the configuration options `config.prefixLocalAnchors` (and optionally also config.baseUrl) in favor of `config.absRefPrefix` **Credits:** Thanks to Gernot Leitgab who discovered and reported the vulnerability. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 95 other vulnerabilities. Affected by 61 other vulnerabilities. |
|
VCID-2n43-4bxg-t3g2
Aliases: CVE-2012-6147 GHSA-qmmw-ch2q-j6xx |
Typo3 Backend API XSS Vulnerability Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3kb3-thyp-huh3
Aliases: CVE-2012-6148 GHSA-rgf6-9q7g-55qg |
Typo3 Function Menu API XSS Vulnerability Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3yv4-3421-tqf4
Aliases: CVE-2012-1606 GHSA-7wwr-p84q-qr3q |
Typo3 Backend XSS Vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. |
|
VCID-6k39-dpuy-8yam
Aliases: CVE-2012-3527 GHSA-m4hw-r893-xh4g |
TYPO3 allows remote authenticated backend users to unserialize arbitrary objects view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)." |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-8139-vreu-2kck
Aliases: CVE-2012-3529 GHSA-7gg8-3r6j-5g55 |
Typo3 Backend Configuration XSS Vulnerability The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ch74-1wa3-2bf5
Aliases: CVE-2014-9508 GHSA-v6xv-rmqc-wcc8 |
Typo3 Open Redirect In Frontend Rendering The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option `config.prefixLocalAnchors` is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri. Installations where `config.absRefPrefix` is additionally set to any value are not affected by this vulnerability. Example of affected configuration: ```php config.absRefPrefix = config.prefixLocalAnchors = all page = PAGE page.10 = TEXT page.10.value = <a href="#skiplinks">Skiplinks</a> .htaccess: RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-l RewriteRule .* index.php [L] ``` |
Affected by 95 other vulnerabilities. Affected by 61 other vulnerabilities. |
|
VCID-e9qd-svur-cfh3
Aliases: CVE-2012-1608 GHSA-w3v6-r62r-fvqh |
Typo3 API XSS Vulnerabilities The `t3lib_div::RemoveXSS` API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters. |
Affected by 0 other vulnerabilities. |
|
VCID-f7um-w67p-9fg8
Aliases: CVE-2012-3528 GHSA-7w6c-5pr4-7qvp |
Typo3 Backend XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-k14s-n1yr-fqhh
Aliases: CVE-2012-2112 GHSA-qfr3-29w6-hwpg |
Typo3 Exception Handler XSS Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages. |
Affected by 0 other vulnerabilities. |
|
VCID-mgdu-yuqg-pbc9
Aliases: CVE-2012-6145 GHSA-w563-rq37-cvq5 |
Typo3 Backend History Module Vulnerable to XSS Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-na5r-a8r1-kfa7
Aliases: CVE-2012-3531 GHSA-p9wg-jvj4-cx26 |
Typo3 Install Tool XSS Vulnerability Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-pf2m-q69d-pqgr
Aliases: CVE-2012-6144 GHSA-947m-vgqc-x6v4 |
Typo3 Backend History Module Vulnerable to SQL Injection SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-s9er-9hug-vbff
Aliases: CVE-2012-6146 GHSA-2hp4-8h6h-93rr |
Typo3 Backend History Module Vulnerable to XSS The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-vqk2-xzjq-rbbn
Aliases: CVE-2012-3530 GHSA-94c2-g68f-9r98 |
Typo3 API XSS Vulnerability Incomplete blacklist vulnerability in the `t3lib_div::quoteJSvalue` API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-w4nd-1kan-xkgw
Aliases: CVE-2012-1605 GHSA-7jfm-px59-99w8 |
Typo3 Extbase Framework Unsafe Deserialization The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument." |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||