Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
184 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Incomplete blacklist vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
Recommended action: Upgrade to 4.7.4, 4.6.12 or 4.5.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.7.4, 4.6.12 or 4.5.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.
Recommended action: Upgrade to 4.7.6, 4.6.14 or 4.5.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.7.6, 4.6.14 or 4.5.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.7.6, 4.6.14 or 4.5.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.7.6, 4.6.14 or 4.5.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
Recommended action: Upgrade to 6.1.7, 6.0.12, 4.7.17 or 4.5.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.
Recommended action: Upgrade to 8.7.5 or 7.6.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.5.346.2.34.7.196.0.146.1.9· Vendor fix available
Issue
TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."
Recommended action: Upgrade to 6.2.3, 6.1.9, 6.0.14 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.5.346.2.34.7.196.0.146.1.9· Vendor fix available
Issue
Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters.
Recommended action: Upgrade to 6.2.3, 6.1.9, 6.0.14 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.
Recommended action: Upgrade to 6.1.9, 6.0.14, 4.7.19 or 4.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The page module in TYPO3 before 8.7.11 has XSS via $GLOBALS['TYPO3CONFVARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
Recommended action: Upgrade to 9.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to showrechis.php and the (2) redirecturl parameter to index.php.
Recommended action: Upgrade to 7.4.0 or 6.2.15 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
Recommended action: Upgrade to 7.3.1 or 6.2.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.
Recommended action: Upgrade to 4.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.
Recommended action: Upgrade to 4.2.10, 4.1.13 or 4.3beta2 (pre-release) by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The jumpUrl mechanism in class.tslibfe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
Recommended action: Upgrade to 4.2.6, 4.1.10 or 4.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Indexed Search Engine (indexedsearch) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.
Recommended action: Upgrade to 4.2.4, 4.1.8 or 4.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.
Recommended action: Upgrade to 4.2.4, 4.1.8 or 4.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables.
Recommended action: Upgrade to 3.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 before 4.5.4 allows Information Disclosure in the backend.
Recommended action: Upgrade to 4.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browselinks wizard.
Recommended action: Upgrade to 4.5.4, 4.4.9 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.
Recommended action: Upgrade to 4.5.4, 4.4.9 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
Recommended action: Upgrade to 4.5.4 or 4.4.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.
Recommended action: Upgrade to 4.5.4, 4.4.9 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.