Vulnerabilities > Typo3 > Medium

DATE CVE VULNERABILITY TITLE RISK
2014-05-20 CVE-2013-4250 Improper Input Validation vulnerability in Typo3
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
network
low complexity
typo3 CWE-20
6.5
2014-05-20 CVE-2012-6146 Permissions, Privileges, and Access Controls vulnerability in Typo3
The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.
network
low complexity
typo3 CWE-264
4.0
2013-12-23 CVE-2013-7081 Permissions, Privileges, and Access Controls vulnerability in Typo3
The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.
network
typo3 CWE-264
4.9
2013-12-23 CVE-2013-7080 Unspecified vulnerability in Typo3
The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted links, aka "Mass Assignment."
network
typo3
5.8
2013-12-23 CVE-2013-7079 Improper Input Validation vulnerability in Typo3
Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
network
typo3 CWE-20
5.8
2013-12-23 CVE-2013-7075 Cryptographic Issues vulnerability in Typo3
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
network
low complexity
typo3 CWE-310
6.5
2013-12-23 CVE-2013-7073 Permissions, Privileges, and Access Controls vulnerability in Typo3
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
network
low complexity
typo3 CWE-264
4.0
2013-12-21 CVE-2013-7082 Cross-Site Scripting vulnerability in Typo3 Flow 1.1.0/2.0.0
Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.
network
typo3 CWE-79
4.3
2013-12-21 CVE-2013-7077 Cross-Site Scripting vulnerability in Typo3
Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
typo3 CWE-79
4.3
2013-12-21 CVE-2013-7076 Cross-Site Scripting vulnerability in Typo3
Cross-site scripting (XSS) vulnerability in Extension Manager in TYPO3 4.5.x before 4.5.32 and 4.7.x before 4.7.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
typo3 CWE-79
4.3