Arbitrary file Upload in extension "Yet Another Gallery" (yag)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: Arbitrary File Upload Affected Versions: 4.2.1 and…

SQL Injection in extension "Event Calender" (pits_wd_calender)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: SQL Injection Affected Versions: 6.0.0 and below…

Cross Site Scripting in extension "Instagram" (ws_instagram)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: Cross Site Scripting Affected Versions: 1.0.1 and…

Cross Site Scripting in extension "gkh RSS Import" (gkh_rss_import)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: Cross Site Scripting Affected Versions: 5.0.0 and…

Multiple vulnerabilities in extension "phpMyAdmin" (phpmyadmin)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: Multiple vulnerabilities Affected Versions: 5.2.4…

Remote Code Execution in extension "ImageOptimizer" (imageoptimizer)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: Remote Code Execution Affected Versions: 2.0.0 and…

Open Redirect in extension "Hairu" (hairu)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: Open Redirect Affected Versions: 3.0.0 and below…

SQL Injection in extension "Faceted Search" (ke_search)

Release Date: May 07, 2019 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Vulnerability Type: SQL Injection Affected Versions: 3.0.0 - 3.0.3…

Cross-Site Scripting in Bootstrap CSS toolkit before 3.4.1 and 4.3.0

Release Date: May 7, 2019 Component Type: Bootstrap CSS toolkit (bundled in TYPO3 core package, ext:core) Impact: Cross-Site Scripting, Known Vulnerability Affected Versions: all Bootstrap versions…

Cross-Site Scripting in jQuery before 3.4.0

Release Date: Date: May 7, 2019 Component: jQuery (bundled in TYPO3 core package, ext:core) Impact: Cross-Site Scripting, Known Vulnerability Affected Versions: all jQuery versions before 3.4.0 CVE:…

Cross-Site Scripting in Fluid Engine

Component Type: TYPO3 CMS Vulnerable subcomponent: Fluid Engine (package typo3fluid/fluid) Release Date: May 7, 2019 Vulnerability Type: Cross-Site Scripting Affected Versions: 8.0.0-8.7.24 and…

Possible Arbitrary Code Execution in Image Processing

Component Type: TYPO3 CMS Vulnerable subcomponent: Image Processing via ImageMagick (ext:core) Release Date: May 7, 2019 Vulnerability Type: Arbitrary Code Execution Affected Versions: 8.0.0-8.7.24…

Information Disclosure in User Authentication

Component Type: TYPO3 CMS Vulnerable subcomponent: User Authentication (ext:core) Release Date: May 7, 2019 Vulnerability Type: Information Disclosure Affected Versions: 9.0.0-9.5.5 Severity: Medium…

Information Disclosure in Page Tree

Component Type: TYPO3 CMS Vulnerable subcomponent: Page Tree (ext:backend) Release Date: May 7, 2019 Vulnerability Type: Information Disclosure Affected Versions: 9.0.0-9.5.5 Severity: Medium…

Results of the TYPO3 Association Elections 2019

The TYPO3 Association elections, that took place between March 21 and April 4 2019, have given the following results: Board members: Result of the Board Election 2019 Name Votes Busemann, Stefan 184…

T3DD 2019—Early Bird Ticket Sale Closing Soon!

Why pay the full price, if you can save money on your tickets? You have a few days left to get one of the discounted Early Bird , Student Early Bird and Sponsoring Early Bird tickets in the online…

PhpStorm—a Short Review

In my opinion it’s a decent IDE especially when using it to its’ full extent. The first important point I want to make is PhpStorm is an IDE , not just an editor. Meaning it might be overkill to use…

T3DD from Devs for Devs—Call for Participation

Share your ideas, talk about your achievements and best practices, or moderate a discussion where the audience gives input to your session. This conference is made for developers and the TYPO3…

Security Team Reboot

In September Helmut Hummel stepped down as Security Team Lead. The Board of the TYPO3 Association appointed Oliver Hader as the new Team Lead. Contact Person for Everything Security-Related He is now…

This Month in TYPO3 - March 2019 - Issue #12

Report on the typo3.org Team Sprint in Wiesbaden (Feb 2019)

Long-time TYPO3 community members will remember their first experiences with TYPO3 and the community behind it. They might recall frustrating moments while trying to write their first line of…

Help Us Shape TYPO3 Karma

The idea is that a measurable involvement in the community will earn you points, much like in a frequent flyer program. Because it is a widely recognized term, we call it “karma”, and there will be…

Introducing the TYPO3 Initiative Week (T3INIT19)

As recent news announced , further development of TYPO3 CMS will focus on development through initiatives . Initiatives consist of independently working teams, driving a specific research area or…

Initiative Report 1/2019

The dashboard initiative is still in an early phase, basic concepts and goals are being defined, organisational stuff is being taken care of. See Dashboard Initiative The persistence initiative is…

The New Faces Behind TYPO3 Core Development

Today, I’m proud to announce the faces behind future Core development: Component Mergers Component mergers are allowed to merge proposed changes that only touch a specific area: Extbase & Plugin API,…