TYPO3 Cross-site scripting (XSS) vulnerability in the click enlarge functionality

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2010-5097 · ADVISORY
• exchange.xforce.ibmcloud.com/vulnerabilities/64178 · WEB
• TYPO3-CMS/frontend · PACKAGE
• web.archive.org/web/20110201071734/http://secunia.com/advisories/35770 · WEB
• web.archive.org/web/20111223211753/http://www.securityfocus.com/bid/45470 · WEB
• typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022 · WEB
• openwall.com/lists/oss-security/2011/01/13/2 · WEB
• openwall.com/lists/oss-security/2012/05/10/7 · WEB
• openwall.com/lists/oss-security/2012/05/11/3 · WEB
• openwall.com/lists/oss-security/2012/05/12/5 · WEB
• secunia.com/advisories/35770
• typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022 · Vendor Advisory
• osvdb.org/70123
• securityfocus.com/bid/45470

typo3/cms-frontend のその他の脆弱性

• CVE-2010-3670中 4.8TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function.
• CVE-2010-3667中 5.3TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element.
• CVE-2010-5098低 3.5Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5…