It has been discovered that the TYPO3 Core is vulnerable to Cross-site scripting, SQL-Injection, Remote shell command execution, Information Disclosure and insecure Install Tool authentication/session handling.
Please read this bulletin for a description and solutions on all mentioned issues: