Vulnerabilities > Typo3 > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-01-27 CVE-2020-8091 Cross-site Scripting vulnerability in Typo3
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
network
low complexity
typo3 CWE-79
6.1
2019-11-06 CVE-2011-4904 Improper Input Validation vulnerability in Typo3
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
network
low complexity
typo3 CWE-20
6.5
2019-11-06 CVE-2011-4903 Cross-site Scripting vulnerability in Typo3
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.
network
low complexity
typo3 CWE-79
6.1
2019-11-06 CVE-2011-4902 Improper Input Validation vulnerability in Typo3
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.
network
low complexity
typo3 CWE-20
6.5
2019-11-06 CVE-2011-4901 Information Exposure vulnerability in Typo3
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.
network
low complexity
typo3 CWE-200
6.5
2019-11-06 CVE-2011-4900 Information Exposure vulnerability in multiple products
TYPO3 before 4.5.4 allows Information Disclosure in the backend.
network
low complexity
typo3 debian CWE-200
6.5
2019-11-06 CVE-2011-4632 Cross-site Scripting vulnerability in Typo3
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.
network
low complexity
typo3 CWE-79
5.4
2019-11-06 CVE-2011-4631 Cross-site Scripting vulnerability in Typo3
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler.
network
low complexity
typo3 CWE-79
5.4
2019-11-06 CVE-2011-4630 Cross-site Scripting vulnerability in Typo3
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.
network
low complexity
typo3 CWE-79
5.4
2019-11-06 CVE-2011-4629 Cross-site Scripting vulnerability in Typo3
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel.
network
low complexity
typo3 CWE-79
5.4