Vulnerabilities > Typo3 > Medium

DATE CVE VULNERABILITY TITLE RISK
2019-11-04 CVE-2010-3663 Unrestricted Upload of File with Dangerous Type vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
network
low complexity
typo3 CWE-434
6.5
2019-11-04 CVE-2010-3662 SQL Injection vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.
network
low complexity
typo3 CWE-89
6.5
2019-11-01 CVE-2010-3661 Open Redirect vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend.
network
typo3 CWE-601
5.8
2019-07-09 CVE-2019-12748 Cross-site Scripting vulnerability in Typo3
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
network
low complexity
typo3 CWE-79
6.1
2017-09-11 CVE-2017-14251 Unrestricted Upload of File with Dangerous Type vulnerability in Typo3
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.
network
low complexity
typo3 CWE-434
6.5
2017-03-17 CVE-2017-6370 Cleartext Transmission of Sensitive Information vulnerability in Typo3 7.6.15
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
network
low complexity
typo3 CWE-319
5.0
2017-01-23 CVE-2016-5091 7PK - Security Features vulnerability in Typo3
Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
network
typo3 CWE-254
6.8
2017-01-23 CVE-2016-4056 Cross-site Scripting vulnerability in Typo3
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.
network
typo3 CWE-79
4.3
2016-01-08 CVE-2015-8760 Improper Input Validation vulnerability in Typo3
The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
network
typo3 CWE-20
4.3
2016-01-08 CVE-2015-8757 Cross-site Scripting vulnerability in Typo3
Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to extension data during an extension installation.
network
typo3 CWE-79
4.3