| CVE-2019-19849 | ALTO8.8 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, wit | 17/12/2019 |
| CVE-2019-19848 | ALTO7.2 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, S | 17/12/2019 |
| CVE-2011-3583 | CRÍTICO9.8 | It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input. | 26/11/2019 |
| CVE-2011-4904 | MEDIO6.5 | TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services. | 06/11/2019 |
| CVE-2011-4903 | MEDIO6.1 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function. | 06/11/2019 |
| CVE-2011-4902 | MEDIO6.5 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver. | 06/11/2019 |
| CVE-2011-4901 | MEDIO6.5 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database. | 06/11/2019 |
| CVE-2011-4900 | MEDIO6.5 | TYPO3 before 4.5.4 allows Information Disclosure in the backend. | 06/11/2019 |
| CVE-2011-4632 | MEDIO5.4 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message. | 06/11/2019 |
| CVE-2011-4630 | MEDIO5.4 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard. | 06/11/2019 |
| CVE-2011-4628 | CRÍTICO9.8 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request. | 06/11/2019 |
| CVE-2011-4627 | MEDIO6.5 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend. | 06/11/2019 |
| CVE-2019-12748 | MEDIO6.1 | TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. | 09/07/2019 |
| CVE-2019-12747 | ALTO8.8 | TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. | 09/07/2019 |
| CVE-2019-10912 | ALTO7.1 | In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpun | 16/05/2019 |
| CVE-2019-11832 | ALTO7.5 | TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. | 09/05/2019 |
| CVE-2018-17960 | MEDIO6.1 | CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. | 14/11/2018 |
| CVE-2018-14041 | MEDIO6.1 | In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. | 13/07/2018 |
| CVE-2018-6905 | MEDIO4.8 | The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process. | 08/04/2018 |
| CVE-2017-14251 | ALTO8.8 | Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code. | 11/09/2017 |