Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
typo3 vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2019-16682
The url_redirect (aka URL redirect) extension up to and including 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.
Url Redirect Project Url Redirect
7.5
CVSSv2
CVE-2019-16700
The slub_events (aka SLUB: Event Registration) extension up to and including 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Servi...
Slub-dresden Slub Events
7.5
CVSSv2
CVE-2019-11831
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x prior to 2.1.1 and 3.x prior to 3.1.1 for TYPO3 does not prevent directory traversal, which allows malicious users to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar...
Typo3 Pharstreamwrapper
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Fedoraproject Fedora 28
Fedoraproject Fedora 29
Fedoraproject Fedora 30
Drupal Drupal
Joomla Joomla\\!
7.5
CVSSv2
CVE-2019-11830
PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x prior to 2.1.1 and 3.x prior to 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows malicious users to bypass a deserialization protection mechanism.
Typo3 Pharstreamwrapper
7.5
CVSSv2
CVE-2019-7743
An issue exists in Joomla! prior to 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
Joomla Joomla\\!
7.5
CVSSv2
CVE-2015-1401
Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
Ldap \\/ Sso Authentication Project Ldap \\/ Sso Authentication 2.0.0
7.5
CVSSv2
CVE-2017-7581
SQL injection vulnerability in NewsController.php in the News module 5.3.2 and previous versions for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.
News System Project News System
7.5
CVSSv2
CVE-2015-4606
Unrestricted file upload vulnerability in the Job Fair (jobfair) extension prior to 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote malicious users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request t...
Job Fair Project Job Fair
7.5
CVSSv2
CVE-2015-4607
Unrestricted file upload vulnerability in the Frontend User Upload (feupload) extension 0.5.0 and previous versions for TYPO3 allows remote malicious users to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a di...
Frontend User Upload Project Frontend User Upload
7.5
CVSSv2
CVE-2015-1403
SQL injection vulnerability in the Content Rating extension 1.0.3 and previous versions for TYPO3 allows remote malicious users to execute arbitrary SQL commands via unspecified vectors.
Content Rating Project Content Rating
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-5248
CVE-2024-3110
CVE-2024-5552
CVE-2024-29415
HTML injection
CVE-2024-3095
TCP
type confusion
CVE-2024-1800
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »