Vulnerabilities > Typo3 > High

DATE CVE VULNERABILITY TITLE RISK
2019-11-04 CVE-2010-3662 SQL Injection vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.
network
low complexity
typo3 CWE-89
8.8
2019-07-09 CVE-2019-12747 Deserialization of Untrusted Data vulnerability in Typo3
TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
network
low complexity
typo3 CWE-502
8.8
2019-05-09 CVE-2019-11832 Improper Input Validation vulnerability in Typo3
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
network
high complexity
typo3 CWE-20
7.5
2017-09-11 CVE-2017-14251 Unrestricted Upload of File with Dangerous Type vulnerability in Typo3
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.
network
low complexity
typo3 CWE-434
8.8
2017-01-23 CVE-2016-5091 7PK - Security Features vulnerability in Typo3
Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
network
high complexity
typo3 CWE-254
8.1
2009-01-22 CVE-2009-0255 Use of Insufficiently Random Values vulnerability in multiple products
The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.
network
low complexity
typo3 debian CWE-330
7.5