Vulnerabilities > Typo3 > Medium

DATE CVE VULNERABILITY TITLE RISK
2019-11-04 CVE-2010-3665 Cross-site Scripting vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.
network
low complexity
typo3 CWE-79
5.4
2019-11-04 CVE-2010-3664 Information Exposure vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend.
network
low complexity
typo3 CWE-200
6.5
2019-11-01 CVE-2010-3661 Open Redirect vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend.
network
low complexity
typo3 CWE-601
6.1
2019-11-01 CVE-2010-3660 Cross-site Scripting vulnerability in Typo3
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.
network
low complexity
typo3 CWE-79
5.4
2019-07-09 CVE-2019-12748 Cross-site Scripting vulnerability in Typo3
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
network
low complexity
typo3 CWE-79
6.1
2018-04-08 CVE-2018-6905 Cross-site Scripting vulnerability in Typo3
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
network
low complexity
typo3 CWE-79
4.8
2017-10-20 CVE-2010-3659 Cross-site Scripting vulnerability in Typo3
Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified parameters to unknown backend forms.
network
low complexity
typo3 CWE-79
5.4
2017-03-17 CVE-2017-6370 Cleartext Transmission of Sensitive Information vulnerability in Typo3 7.6.15
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
network
low complexity
typo3 CWE-319
5.3
2017-01-23 CVE-2016-4056 Cross-site Scripting vulnerability in Typo3
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.
network
low complexity
typo3 CWE-79
6.1
2016-01-08 CVE-2015-8760 Improper Input Validation vulnerability in Typo3
The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
network
low complexity
typo3 CWE-20
6.1