Search criteria
710 vulnerabilities found for typo3 by typo3
FKIE_CVE-2007-6381
Vulnerability from fkie_nvd - Published: 2007-12-15 02:46 - Updated: 2025-04-09 00:30
Severity ?
Summary
SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| typo3 | typo3 | * | |
| typo3 | typo3 | 3.0 | |
| typo3 | typo3 | 3.7.0 | |
| typo3 | typo3 | 3.7.1 | |
| typo3 | typo3 | 3.8 | |
| typo3 | typo3 | 3.8.1 | |
| typo3 | typo3 | 4.0 | |
| typo3 | typo3 | 4.0.1 | |
| typo3 | typo3 | 4.0.2 | |
| typo3 | typo3 | 4.0.3 | |
| typo3 | typo3 | 4.0.4 | |
| typo3 | typo3 | 4.0.5 | |
| typo3 | typo3 | 4.0.6 | |
| typo3 | typo3 | 4.0.7 | |
| typo3 | typo3 | 4.1 | |
| typo3 | typo3 | 4.1.1 | |
| typo3 | typo3 | 4.1.2 | |
| typo3 | typo3 | 4.1.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5F1C59B0-CDF2-4F9A-88C7-61E8F18590DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "395C04FB-3390-4E97-B2F1-BEF9C42F15E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E53B002D-18FD-4C6A-97C0-AA9C83ABD382",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3885B69F-B9C0-488F-8775-E8E801418E57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A3390E31-A149-4D83-94D2-63AF63D02A01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA565238-52C8-4850-8FDA-C38C057BF6F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "25EAE65C-1E17-48CD-B48C-E0BC09FB6596",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "501A9157-044A-4856-8092-418D7329EED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4EA47174-9BC4-4B74-8618-6A7B0773553B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5A13146E-EC04-4354-9123-BC7CB292C66A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F27B173-8D10-47F7-8450-F8808A918295",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1FAD0A-6B98-476B-BCD2-361996CA1C36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AE992D57-AF82-4BF0-96E8-98110C0AEBF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7A9A484F-C34D-4885-8125-D9C8725EEB4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C2F271C6-B5A7-4B06-A3DF-4C7F74090CC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "161E310F-F2D8-40B3-8390-8C52ACDD0B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F6B33D32-4D59-4768-A2C6-9DC7CD30F5E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4679B5DF-25FA-40E9-A322-DF1FF1BC7E7C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en la extensi\u00f3n del sistema indexed_search, en TYPO3 3.x, 4.0 hasta 4.0.7, y 4.1 hasta 4.1.3. Permite que usuarios autenticados remotamente ejecuten, a su elecci\u00f3n, comandos SQL usando vectores sin especificar."
}
],
"id": "CVE-2007-6381",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-12-15T02:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/39506"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27969"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/28243"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1019146"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2007/dsa-1439"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26871"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/39506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27969"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/28243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1019146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2007/dsa-1439"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26871"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2007-1081
Vulnerability from fkie_nvd - Published: 2007-02-22 23:28 - Updated: 2025-04-09 00:30
Severity ?
Summary
The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E2688D4A-AD32-4D78-ADE2-C69EAB910752",
"versionEndIncluding": "4.0.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:*:beta:*:*:*:*:*:*",
"matchCriteriaId": "608D2A64-4748-4656-A74C-80E222CA98C2",
"versionEndIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:*:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BD5415F7-97FC-4B74-A862-9FE04D5D41B0",
"versionEndIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information."
},
{
"lang": "es",
"value": "La funci\u00f3n start en class.t3lib_formmail.php en TYPO3 anterior a 4.0.5, 4.1beta, y 4.1RC1 permite a atacantes remotos inyectar cabeceras email de su elecci\u00f3n a trav\u00e9s de vectores desconocidos. NOTA: Algunos de estos detalles se obtuvieron de informaci\u00f3n de terceros."
}
],
"id": "CVE-2007-1081",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-02-22T23:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/33471"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/24207"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22668"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/33471"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/24207"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22668"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2006-6690
Vulnerability from fkie_nvd - Published: 2006-12-21 21:28 - Updated: 2025-04-09 00:30
Severity ?
Summary
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:typo3:typo3:3.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E53B002D-18FD-4C6A-97C0-AA9C83ABD382",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A3390E31-A149-4D83-94D2-63AF63D02A01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "25EAE65C-1E17-48CD-B48C-E0BC09FB6596",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "501A9157-044A-4856-8092-418D7329EED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4EA47174-9BC4-4B74-8618-6A7B0773553B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5A13146E-EC04-4354-9123-BC7CB292C66A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
},
{
"lang": "es",
"value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php en Typo3 4.0.0 hasta 4.0.3, 3.7 y 3.8 con la extensi\u00f3n rtehtmlarea, y 4.1 beta, permite a atacantes remotos autenticados ejecutar comandos de su elecci\u00f3n mediante metacaracteres del int\u00e9rprete de comandos (shell) a trav\u00e9s del par\u00e1metro userUid en rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php,\r\ny posiblemente otro vector."
}
],
"evaluatorSolution": "his vulnerability is addressed in the following product release:\r\nTypo3, Typo3, 4.0.4",
"id": "CVE-2006-6690",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-12-21T21:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23446"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23466"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2056"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://securitytracker.com/id?1017428"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.sec-consult.com/272.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/21680"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/5094"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23446"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23466"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2056"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://securitytracker.com/id?1017428"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.sec-consult.com/272.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/21680"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/5094"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2006-5069
Vulnerability from fkie_nvd - Published: 2006-09-28 00:07 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DF9C28A4-7F2C-492D-8514-63C598DC8BA6",
"versionEndIncluding": "4.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "25EAE65C-1E17-48CD-B48C-E0BC09FB6596",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en class.tx_indexedsearch.php en la extensi\u00f3n Indexed Search 2.9.0 para Typo3 en versiones anteriores a 4.0.2 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro de b\u00fasqueda."
}
],
"id": "CVE-2006-5069",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2006-09-28T00:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22071"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1646"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/20173"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22071"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1646"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/20173"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2006-0327
Vulnerability from fkie_nvd - Published: 2006-01-21 00:03 - Updated: 2025-04-03 01:03
Severity ?
Summary
TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:typo3:typo3:3.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3885B69F-B9C0-488F-8775-E8E801418E57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA565238-52C8-4850-8FDA-C38C057BF6F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails."
}
],
"id": "CVE-2006-0327",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-21T00:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18546"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/361"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/22665"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/22666"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/22667"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18546"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/361"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/22665"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/22666"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/22667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2005-4875
Vulnerability from fkie_nvd - Published: 2005-12-31 05:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1AC79A8A-0227-446D-A38E-AFB424522509",
"versionEndIncluding": "3.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D954FE3D-B766-4D39-B0CA-31A24EDB362C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:typo3:typo3:3.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E53B002D-18FD-4C6A-97C0-AA9C83ABD382",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables."
}
],
"id": "CVE-2005-4875",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://bugs.typo3.org/view.php?id=1250"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20050725-1/"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42457"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.typo3.org/view.php?id=1250"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20050725-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42457"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2007-6381 (GCVE-0-2007-6381)
Vulnerability from cvelistv5 – Published: 2007-12-15 02:00 – Updated: 2024-08-07 16:02
VLAI?
Summary
SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:02:36.726Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "28243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"name": "ADV-2007-4205",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"name": "39506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/39506"
},
{
"name": "1019146",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1019146"
},
{
"name": "26871",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26871"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"name": "typo3-indexedsearch-sql-injection(39017)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
},
{
"name": "27969",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27969"
},
{
"name": "DSA-1439",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2007/dsa-1439"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-12-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "28243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"name": "ADV-2007-4205",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"name": "39506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/39506"
},
{
"name": "1019146",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1019146"
},
{
"name": "26871",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26871"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"name": "typo3-indexedsearch-sql-injection(39017)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
},
{
"name": "27969",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27969"
},
{
"name": "DSA-1439",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2007/dsa-1439"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-6381",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "28243",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28243"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"name": "ADV-2007-4205",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"name": "39506",
"refsource": "OSVDB",
"url": "http://osvdb.org/39506"
},
{
"name": "1019146",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1019146"
},
{
"name": "26871",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26871"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446",
"refsource": "MISC",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"name": "typo3-indexedsearch-sql-injection(39017)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
},
{
"name": "27969",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27969"
},
{
"name": "DSA-1439",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2007/dsa-1439"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-6381",
"datePublished": "2007-12-15T02:00:00",
"dateReserved": "2007-12-14T00:00:00",
"dateUpdated": "2024-08-07T16:02:36.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-1081 (GCVE-0-2007-1081)
Vulnerability from cvelistv5 – Published: 2007-02-22 23:00 – Updated: 2024-08-07 12:43
VLAI?
Summary
The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:43:22.540Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"name": "typo3-t3libformmail-header-injection(32630)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
},
{
"name": "24207",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24207"
},
{
"name": "ADV-2007-0697",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"name": "33471",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/33471"
},
{
"name": "22668",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22668"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-02-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"name": "typo3-t3libformmail-header-injection(32630)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
},
{
"name": "24207",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24207"
},
{
"name": "ADV-2007-0697",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"name": "33471",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/33471"
},
{
"name": "22668",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22668"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1081",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"name": "typo3-t3libformmail-header-injection(32630)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
},
{
"name": "24207",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24207"
},
{
"name": "ADV-2007-0697",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"name": "33471",
"refsource": "OSVDB",
"url": "http://osvdb.org/33471"
},
{
"name": "22668",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22668"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1081",
"datePublished": "2007-02-22T23:00:00",
"dateReserved": "2007-02-22T00:00:00",
"dateUpdated": "2024-08-07T12:43:22.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-6690 (GCVE-0-2006-6690)
Vulnerability from cvelistv5 – Published: 2006-12-21 21:00 – Updated: 2024-08-07 20:33
VLAI?
Summary
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:33:59.962Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"name": "23466",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23466"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.sec-consult.com/272.html"
},
{
"name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"name": "1017428",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017428"
},
{
"name": "2056",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2056"
},
{
"name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"name": "23446",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23446"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"name": "ADV-2006-5094",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/5094"
},
{
"name": "21680",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21680"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-12-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"name": "23466",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23466"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.sec-consult.com/272.html"
},
{
"name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"name": "1017428",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017428"
},
{
"name": "2056",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2056"
},
{
"name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"name": "23446",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23446"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"name": "ADV-2006-5094",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/5094"
},
{
"name": "21680",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21680"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6690",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"name": "23466",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23466"
},
{
"name": "http://www.sec-consult.com/272.html",
"refsource": "MISC",
"url": "http://www.sec-consult.com/272.html"
},
{
"name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
"refsource": "MLIST",
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"name": "1017428",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017428"
},
{
"name": "2056",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2056"
},
{
"name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
"refsource": "MLIST",
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"name": "23446",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23446"
},
{
"name": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9",
"refsource": "CONFIRM",
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"name": "ADV-2006-5094",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/5094"
},
{
"name": "21680",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21680"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6690",
"datePublished": "2006-12-21T21:00:00",
"dateReserved": "2006-12-21T00:00:00",
"dateUpdated": "2024-08-07T20:33:59.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-5069 (GCVE-0-2006-5069)
Vulnerability from cvelistv5 – Published: 2006-09-28 00:00 – Updated: 2024-08-07 19:32
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T19:32:23.395Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-3782",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"name": "22071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22071"
},
{
"name": "typo3-search-xss(29128)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
},
{
"name": "20173",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/20173"
},
{
"name": "1646",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1646"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\" v2.9.0",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\"",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-09-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-3782",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"name": "22071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22071"
},
{
"name": "typo3-search-xss(29128)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
},
{
"name": "20173",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/20173"
},
{
"name": "1646",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1646"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\" v2.9.0",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\"",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-5069",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-3782",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"name": "22071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22071"
},
{
"name": "typo3-search-xss(29128)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
},
{
"name": "20173",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/20173"
},
{
"name": "1646",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1646"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\" v2.9.0",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\"",
"refsource": "FULLDISC",
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-5069",
"datePublished": "2006-09-28T00:00:00",
"dateReserved": "2006-09-27T00:00:00",
"dateUpdated": "2024-08-07T19:32:23.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-0327 (GCVE-0-2006-0327)
Vulnerability from cvelistv5 – Published: 2006-01-21 00:00 – Updated: 2024-08-07 16:34
VLAI?
Summary
TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:13.606Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"name": "361",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/361"
},
{
"name": "22666",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22666"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"name": "typo3-multiple-path-disclosure(24244)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
},
{
"name": "22665",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22665"
},
{
"name": "18546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18546"
},
{
"name": "ADV-2006-0269",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"name": "20060119 IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"name": "22667",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22667"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"name": "361",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/361"
},
{
"name": "22666",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22666"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"name": "typo3-multiple-path-disclosure(24244)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
},
{
"name": "22665",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22665"
},
{
"name": "18546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18546"
},
{
"name": "ADV-2006-0269",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"name": "20060119 IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"name": "22667",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22667"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0327",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"name": "361",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/361"
},
{
"name": "22666",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22666"
},
{
"name": "http://bugs.typo3.org/view.php?id=2248",
"refsource": "MISC",
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"name": "http://www.irmplc.com/advisory015.htm",
"refsource": "MISC",
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"name": "typo3-multiple-path-disclosure(24244)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
},
{
"name": "22665",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22665"
},
{
"name": "18546",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18546"
},
{
"name": "ADV-2006-0269",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"name": "20060119 IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"name": "22667",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22667"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0327",
"datePublished": "2006-01-21T00:00:00",
"dateReserved": "2006-01-20T00:00:00",
"dateUpdated": "2024-08-07T16:34:13.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-6381 (GCVE-0-2007-6381)
Vulnerability from nvd – Published: 2007-12-15 02:00 – Updated: 2024-08-07 16:02
VLAI?
Summary
SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:02:36.726Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "28243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"name": "ADV-2007-4205",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"name": "39506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/39506"
},
{
"name": "1019146",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1019146"
},
{
"name": "26871",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26871"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"name": "typo3-indexedsearch-sql-injection(39017)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
},
{
"name": "27969",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27969"
},
{
"name": "DSA-1439",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2007/dsa-1439"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-12-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "28243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"name": "ADV-2007-4205",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"name": "39506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/39506"
},
{
"name": "1019146",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1019146"
},
{
"name": "26871",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26871"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"name": "typo3-indexedsearch-sql-injection(39017)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
},
{
"name": "27969",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27969"
},
{
"name": "DSA-1439",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2007/dsa-1439"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-6381",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "28243",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28243"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
},
{
"name": "ADV-2007-4205",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/4205"
},
{
"name": "39506",
"refsource": "OSVDB",
"url": "http://osvdb.org/39506"
},
{
"name": "1019146",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1019146"
},
{
"name": "26871",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26871"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446",
"refsource": "MISC",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446"
},
{
"name": "typo3-indexedsearch-sql-injection(39017)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39017"
},
{
"name": "27969",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27969"
},
{
"name": "DSA-1439",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2007/dsa-1439"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-6381",
"datePublished": "2007-12-15T02:00:00",
"dateReserved": "2007-12-14T00:00:00",
"dateUpdated": "2024-08-07T16:02:36.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-1081 (GCVE-0-2007-1081)
Vulnerability from nvd – Published: 2007-02-22 23:00 – Updated: 2024-08-07 12:43
VLAI?
Summary
The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:43:22.540Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"name": "typo3-t3libformmail-header-injection(32630)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
},
{
"name": "24207",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24207"
},
{
"name": "ADV-2007-0697",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"name": "33471",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/33471"
},
{
"name": "22668",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22668"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-02-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"name": "typo3-t3libformmail-header-injection(32630)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
},
{
"name": "24207",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24207"
},
{
"name": "ADV-2007-0697",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"name": "33471",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/33471"
},
{
"name": "22668",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22668"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1081",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors. NOTE: some details were obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20070221-1"
},
{
"name": "typo3-t3libformmail-header-injection(32630)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32630"
},
{
"name": "24207",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24207"
},
{
"name": "ADV-2007-0697",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0697"
},
{
"name": "33471",
"refsource": "OSVDB",
"url": "http://osvdb.org/33471"
},
{
"name": "22668",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22668"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1081",
"datePublished": "2007-02-22T23:00:00",
"dateReserved": "2007-02-22T00:00:00",
"dateUpdated": "2024-08-07T12:43:22.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-6690 (GCVE-0-2006-6690)
Vulnerability from nvd – Published: 2006-12-21 21:00 – Updated: 2024-08-07 20:33
VLAI?
Summary
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:33:59.962Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"name": "23466",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23466"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.sec-consult.com/272.html"
},
{
"name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"name": "1017428",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017428"
},
{
"name": "2056",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2056"
},
{
"name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"name": "23446",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23446"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"name": "ADV-2006-5094",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/5094"
},
{
"name": "21680",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21680"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-12-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"name": "23466",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23466"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.sec-consult.com/272.html"
},
{
"name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"name": "1017428",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017428"
},
{
"name": "2056",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2056"
},
{
"name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"name": "23446",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23446"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"name": "ADV-2006-5094",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/5094"
},
{
"name": "21680",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21680"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6690",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
},
{
"name": "23466",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23466"
},
{
"name": "http://www.sec-consult.com/272.html",
"refsource": "MISC",
"url": "http://www.sec-consult.com/272.html"
},
{
"name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
"refsource": "MLIST",
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
},
{
"name": "1017428",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017428"
},
{
"name": "2056",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2056"
},
{
"name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
"refsource": "MLIST",
"url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
},
{
"name": "23446",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23446"
},
{
"name": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9",
"refsource": "CONFIRM",
"url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
},
{
"name": "ADV-2006-5094",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/5094"
},
{
"name": "21680",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21680"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6690",
"datePublished": "2006-12-21T21:00:00",
"dateReserved": "2006-12-21T00:00:00",
"dateUpdated": "2024-08-07T20:33:59.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-5069 (GCVE-0-2006-5069)
Vulnerability from nvd – Published: 2006-09-28 00:00 – Updated: 2024-08-07 19:32
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T19:32:23.395Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-3782",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"name": "22071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22071"
},
{
"name": "typo3-search-xss(29128)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
},
{
"name": "20173",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/20173"
},
{
"name": "1646",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1646"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\" v2.9.0",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\"",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-09-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-3782",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"name": "22071",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22071"
},
{
"name": "typo3-search-xss(29128)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
},
{
"name": "20173",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/20173"
},
{
"name": "1646",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1646"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\" v2.9.0",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\"",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-5069",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-3782",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/3782"
},
{
"name": "22071",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22071"
},
{
"name": "typo3-search-xss(29128)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29128"
},
{
"name": "20173",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/20173"
},
{
"name": "1646",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1646"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\" v2.9.0",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/446885/100/0/threaded"
},
{
"name": "20060925 Typo3 v4.x: XSS in extension \"Indexed Search\"",
"refsource": "FULLDISC",
"url": "http://marc.info/?l=full-disclosure\u0026m=115918334930694\u0026w=2"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-5069",
"datePublished": "2006-09-28T00:00:00",
"dateReserved": "2006-09-27T00:00:00",
"dateUpdated": "2024-08-07T19:32:23.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-0327 (GCVE-0-2006-0327)
Vulnerability from nvd – Published: 2006-01-21 00:00 – Updated: 2024-08-07 16:34
VLAI?
Summary
TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:13.606Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"name": "361",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/361"
},
{
"name": "22666",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22666"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"name": "typo3-multiple-path-disclosure(24244)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
},
{
"name": "22665",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22665"
},
{
"name": "18546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18546"
},
{
"name": "ADV-2006-0269",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"name": "20060119 IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"name": "22667",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22667"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"name": "361",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/361"
},
{
"name": "22666",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22666"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"name": "typo3-multiple-path-disclosure(24244)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
},
{
"name": "22665",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22665"
},
{
"name": "18546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18546"
},
{
"name": "ADV-2006-0269",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"name": "20060119 IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"name": "22667",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22667"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0327",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/422390/100/0/threaded"
},
{
"name": "361",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/361"
},
{
"name": "22666",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22666"
},
{
"name": "http://bugs.typo3.org/view.php?id=2248",
"refsource": "MISC",
"url": "http://bugs.typo3.org/view.php?id=2248"
},
{
"name": "http://www.irmplc.com/advisory015.htm",
"refsource": "MISC",
"url": "http://www.irmplc.com/advisory015.htm"
},
{
"name": "typo3-multiple-path-disclosure(24244)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24244"
},
{
"name": "22665",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22665"
},
{
"name": "18546",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18546"
},
{
"name": "ADV-2006-0269",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0269"
},
{
"name": "20060119 IRM 015: File system path disclosure on TYPO3 Web Content Manager",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/422360/100/0/threaded"
},
{
"name": "22667",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22667"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0327",
"datePublished": "2006-01-21T00:00:00",
"dateReserved": "2006-01-20T00:00:00",
"dateUpdated": "2024-08-07T16:34:13.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CERTA-2007-AVI-543
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité dans TYPO3 permet d'injecter des commandes SQL.
Description
Une vulnérabilité a été découverte dans TYPO3. Celle-ci permet d'injecter des commandes SQL par l'intermédiaire de l'extension indexed_search. Cependant, il est nécessaire de disposer d'un compte utilisateur pour pouvoir exploiter la vulnérabilité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "TYPO3 versions 4.0 \u00e0 4.0.7 ;",
"product": {
"name": "Typo3",
"vendor": {
"name": "Typo3",
"scada": false
}
}
},
{
"description": "TYPO3 versions 4.1 \u00e0 4.1.3.",
"product": {
"name": "Typo3",
"vendor": {
"name": "Typo3",
"scada": false
}
}
},
{
"description": "TYPO3 versions 3.x ;",
"product": {
"name": "Typo3",
"vendor": {
"name": "Typo3",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans TYPO3. Celle-ci permet\nd\u0027injecter des commandes SQL par l\u0027interm\u00e9diaire de l\u0027extension\nindexed_search. Cependant, il est n\u00e9cessaire de disposer d\u0027un compte\nutilisateur pour pouvoir exploiter la vuln\u00e9rabilit\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"links": [],
"reference": "CERTA-2007-AVI-543",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2007-12-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de commandes SQL"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eTYPO3\u003c/span\u003e permet\nd\u0027injecter des commandes SQL.\n",
"title": "vuln\u00e9rabilit\u00e9 dans TYPO3",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 TYPO3 20071210-1 du 10 d\u00e9cembre 2007",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20071210-1/"
}
]
}
CERTA-2006-AVI-565
Vulnerability from certfr_avis - Published: - Updated:None
Description
L'extension rtehtmlarea est installée par défaut dans le gestionnaire de contenu Typo3 dans les versions 4.0 à 4.0.3 et 4.1 beta. Cette extension peut également être installée en module externe.
Une vulnérabilité a été découverte dans le module class.tx_rtehtmlarea_pi1.php de l'extension rtehtmlarea. Un utilisateur malintentionné peut, par le biais de requêtes HTTP, exécuter du code arbitraire à distance.
L'exploitation de cette vulnérabilité ne fonctionne pas si l'option PHP safe_mode a été activée.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "extension rtehtmlarea versions 0.7.5 \u00e0 1.4.2 (sauf 1.1.4, 1.2.1 et 1.3.8).",
"product": {
"name": "N/A",
"vendor": {
"name": "Typo3",
"scada": false
}
}
},
{
"description": "Typo3 versions 4.0 \u00e0 4.0.3 ;",
"product": {
"name": "Typo3",
"vendor": {
"name": "Typo3",
"scada": false
}
}
},
{
"description": "Typo3 version 4.1 beta ;",
"product": {
"name": "Typo3",
"vendor": {
"name": "Typo3",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nL\u0027extension rtehtmlarea est install\u00e9e par d\u00e9faut dans le gestionnaire de\ncontenu Typo3 dans les versions 4.0 \u00e0 4.0.3 et 4.1 beta. Cette extension\npeut \u00e9galement \u00eatre install\u00e9e en module externe.\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le module\nclass.tx_rtehtmlarea_pi1.php de l\u0027extension rtehtmlarea. Un utilisateur\nmalintentionn\u00e9 peut, par le biais de requ\u00eates HTTP, ex\u00e9cuter du code\narbitraire \u00e0 distance.\n\nL\u0027exploitation de cette vuln\u00e9rabilit\u00e9 ne fonctionne pas si l\u0027option PHP\nsafe_mode a \u00e9t\u00e9 activ\u00e9e.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"links": [],
"reference": "CERTA-2006-AVI-565",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2006-12-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": null,
"title": "Vuln\u00e9rabilit\u00e9 dans Typo3",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 TYPO3-20061220-1 du 20 d\u00e9cembre 2006",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20061220-1/"
}
]
}