TYPO3 Cross-site scripting (XSS) vulnerability in the click enlarge functionality

Description

References

• nvd.nist.gov/vuln/detail/CVE-2010-5097 · ADVISORY
• exchange.xforce.ibmcloud.com/vulnerabilities/64178 · WEB
• TYPO3-CMS/frontend · PACKAGE
• web.archive.org/web/20110201071734/http://secunia.com/advisories/35770 · WEB
• web.archive.org/web/20111223211753/http://www.securityfocus.com/bid/45470 · WEB
• typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022 · WEB
• openwall.com/lists/oss-security/2011/01/13/2 · WEB
• openwall.com/lists/oss-security/2012/05/10/7 · WEB
• openwall.com/lists/oss-security/2012/05/11/3 · WEB
• openwall.com/lists/oss-security/2012/05/12/5 · WEB
• secunia.com/advisories/35770

Autres vulnérabilités de typo3/cms-frontend

• CVE-2010-3670MOYENNE 4.8TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function.
• CVE-2010-3667MOYENNE 5.3TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element.
• CVE-2010-5098FAIBLE 3.5Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5…