Security Advisories
All Advisories
TYPO3-CORE-SA-2024-012: Information Disclosure in TYPO3 Page Tree
It has been discovered that TYPO3 CMS is susceptible to information disclosure.
TYPO3-CORE-SA-2024-011: Denial of Service in TYPO3 Bookmark Toolbar
It has been discovered that TYPO3 CMS is susceptible to denial of service.
TYPO3-EXT-SA-2024-007: Insecure Direct Object Reference in extension "powermail" (powermail)
It has been discovered that the extension "powermail" (powermail) is susceptible to Insecure Direct Object Reference.
TYPO3-EXT-SA-2024-006: Multiple vulnerabilities in "powermail" (powermail)
It has been discovered that the extension "powermail" (powermail) is susceptible to Insecure Direct Object Reference and Broken Access Control.
TYPO3-EXT-SA-2024-005: Multiple vulnerabilities in "Aimeos shop and e-commerce framework" (aimeos)
It has been discovered that the extension "Aimeos shop and e-commerce framework" (aimeos) is susceptible to Remote Code Execution and Insecure Direct…
TYPO3-EXT-SA-2024-004: Broken Access Control in "Integration of Friendly Captcha" (friendlycaptcha_official)
It has been discovered that the extension "Integration of Friendly Captcha" (friendlycaptcha_official) is susceptible to Broken Access Control.
TYPO3-EXT-SA-2024-003: Multiple vulnerabilities in "Events 2" (events2)
It has been discovered that the extension "Events 2" (events2) is susceptible to Cache Poisoning, Insecure Direct Object Reference and SQL wildcard…
TYPO3-CORE-SA-2024-010: Uncontrolled Resource Consumption in ShowImageController
It has been discovered that TYPO3 CMS is susceptible to denial of service.
TYPO3-CORE-SA-2024-009: Cross-Site Scripting in ShowImageController
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.
TYPO3-CORE-SA-2024-008: Cross-Site Scripting in Form Manager Module
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.
TYPO3-CORE-SA-2024-007: HTML Injection in History Module
It has been discovered that TYPO3 CMS is vulnerable to HTML injection.
TYPO3-EXT-SA-2024-002: Authentication Bypass in "OpenID Connect Authentication" (oidc)
It has been discovered that the extension "OpenID Connect Authentication" (oidc) is susceptible to Authentication Bypass.
TYPO3-EXT-SA-2024-001: Broken Access Control in extension "Event management and registration" (sf_event_mgt)
It has been discovered that the extension "Event management and registration" (sf_event_mgt) is susceptible to Broken Access Control.
TYPO3-CORE-SA-2024-006: Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
It has been discovered that TYPO3 CMS is susceptible to information disclosure.
TYPO3-CORE-SA-2024-005: Improper Access Control of Resources Referenced by t3:// URI Scheme
It has been discovered that TYPO3 CMS is susceptible to information disclosure.
TYPO3-CORE-SA-2024-004: Information Disclosure of Encryption Key in TYPO3 Install Tool
It has been discovered that TYPO3 CMS is susceptible to information disclosure.
TYPO3-CORE-SA-2024-003: Information Disclosure of Hashed Passwords in TYPO3 Backend Forms
It has been discovered that TYPO3 CMS is susceptible to information disclosure.
TYPO3-CORE-SA-2024-002: Code Execution in TYPO3 Install Tool
It has been discovered that TYPO3 CMS is vulnerable to code execution.
TYPO3-CORE-SA-2024-001: Path Traversal in TYPO3 File Abstraction Layer Storages
It has been discovered that TYPO3 CMS is susceptible to path traversal.
TYPO3-EXT-SA-2023-011: Configuration Injection in extension "Direct Mail" (direct_mail)
It has been discovered that the extension "Direct Mail" (direct_mail) is susceptible to Configuration Injection.