Information Disclosure in TYPO3 CMS

Component Type: TYPO3 CMS Release Date: September 5, 2017 Vulnerability Type: Information Disclosure Affected Versions: 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 Severity: Low Suggested CVSS v2.0:…

CSV Code Injection

Component Type: 3rd party extensions (not being part of TYPO3 default installation) Release Date: July 20, 2021 Impact: CSV Code Injection Type: Advisory Problem Description CSV code injection is an…

Secrets and Benefits of the TYPO3 Professional Service Listing (PSL)

Those accepted and included in the Professional Services Listing have proven to be highly professional TYPO3 agencies (big or small!) and are active participants in the TYPO3 universe. If you are not…

Submit your 2017 budget application

Mike is back! Still motivated and enthusiast to be part of a great Open Source community, Mike wants to further share his ideas and knowledge in 2017. Just like him, you can download the budget…

Cross-Site Scripting in Content Preview

Component Type: TYPO3 CMS Subcomponent: Content Preview Renderer (ext:backend) Release Date: March 16, 2021 Vulnerability Type: Cross-Site Scripting Affected Versions: 10.0.0-10.4.1, 11.0.0-11.1.0…

Cross-Site Scripting in Form Framework

Component Type: TYPO3 CMS Subcomponent: Form Framework (ext:form) Release Date: March 16, 2021 Vulnerability Type: Cross-Site Scripting Affected Versions: 10.2.0-10.4.13, 11.0.0-11.1.0 Severity:…

Caching at TYPO3.org

Yesterday night we finally upgraded TYPO3.org to version 3.8.0. Because we had to clear all caches, including the indexed_search cache, the pages were rendered quite slowly in the time following.…

TYPO3 Hyphenator (xrhyphen)

Adds Hyphenation-Functions to TYPO3. To use this extension simply install it and add the static template "TYPO3 Hyphenation (xrhyphen)" to your root-page. Special thanks to the developers of the…

Show extension details Download ZIP of version 1.0.0

TYPO3 Summer of Code 2012 - it happens!

I wrote down some basic rules and a roadmap for the summer in the wiki on http://wiki.typo3.org/T3soc2012 . Now it's your turn to hand in a project proposal. We are really looking forward to it. Basic…

TYPO3 Security Bulletin

Component Type: Third Party Extension. This extension is third party code that has not been submitted to the TYPO3 extension review process yet. The extension is not part of TYPO3 default…

Cross-Site Scripting in Backend Modal Component

Component Type: TYPO3 CMS Vulnerable subcomponent: Backend modal component Release Date: December 11, 2018 Vulnerability Type: Cross-Site Scripting Affected Versions: 7.1.0-7.6.31, 8.5.0-8.7.20 and…

Steering Committee Strategical Meeting

Strategy Benni tells about the past User eXperience Week (T3UXW09) and how much work can be done during such a week. We will definitely repeat these 'code sprints'. We will keep aiming TYPO3 as “The…

Cross-Site Scripting in extension "Extension Kickstarter" (kickstarter)

Release Date: March 03, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 0.5.3 and below Vulnerability Type:…

Cross-Site Scripting in TYPO3 component CSS styled content

Component Type: TYPO3 CMS Release Date: February 23, 2016 Vulnerable subcomponent: CSS styled content Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.18 and 7.6.0 to…

Cross-Site Scripting in link validator component

Component Type: TYPO3 CMS Release Date: February 16, 2016 Vulnerable subcomponent: link validator Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.17 and 7.6.0 to…

TYPO3 in the Cloud – User Group meets Microsoft

Topics of the meeting are TYPO3 in the cloud with Microsoft Azure and Platform.sh, the Microsoft Cloud Germany and the new Form Framework in TYPO3 8.5. Microsoft and open source Microsoft has…

Cross-Site Scripting in Form Engine

Component Type: TYPO3 CMS Subcomponent: Form Engine (ext:backend) Release Date: May 12, 2020 Vulnerability Type: Cross-Site Scripting Affected Versions: 9.0.0-9.5.16, 10.0.0-10.4.1 Severity: Medium…

Sensitive Data Exposure in extension "Job Fair" (jobfair)

Release Date: May 12, 2020 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: Job Fair (ext:jobfair) Vulnerability Type: Sensitive Data…

Budget 2024 Ideas for Quarter 4/2024 Published — Vote Now!

On 2 August 2024, we launched the community budget process for 2024 with a call for budget ideas. The ideas are now published at talk.typo3.org , where you can review and discuss them . As a part of…

Social media buttons (social_media_buttons)

Embed the customised Social Media Buttons, like Facebook, Twitter, YouTube, Google Plus, Linkedin and Pinterest to your Website. Add Simple Social Buttons to your website and multiply your…

Show extension details Download ZIP of version 1.1.6 Extension documentation

Remote Code Execution in third party library swiftmailer

Component Type: TYPO3 CMS Release Date: January 3, 2017 Vulnerability Type: Remote Code Execution Affected Versions: 6.2.0 to 6.2.29, 7.6.0 to 7.6.14 and 8.0.0 to 8.5.0 Severity: Low Suggested CVSS…

The new frontend editing for TYPO3

For us as TYPO3 Core team, Frontend Editing plays an important part for the ease-of-use for TYPO3. It adds a missing piece which has been neglected for too long. On the other hand, the source code of…

Business Control Committee

The Business Control Committee (BCC) The BCC monitors the Association's activities and finances. The Business Control Committee is elected by the Association's Members at the General Assembly . It works to increase transparency. It manages budgets…

Insufficient Session Expiration in Admin Tool

Component Type: TYPO3 CMS Subcomponent: Admin Tool (ext:install) Release Date: June 14, 2022 Vulnerability Type: Broken Access Control Affected Versions: 9.0.0-9.5.34 ELTS, 10.0.0-10.4.28,…

Insecure Deserialization in TYPO3 CMS

Component Type: TYPO3 CMS Vulnerable subcomponent: Backend & Core API (ext:backend, ext:core) Release Date: June 25, 2019 Vulnerability Type: Insecure Deserialization Affected Versions: 8.0.0-8.7.26…