Posts by date: 2005 / 11 en https://news.typo3.com/article/archive/2005/november/blog.archive.xml Tue, 28 Jul 2026 15:14:39 +0200 https://news.typo3.com/article/typo3-swot-analysishttps://news.typo3.com/article/typo3-swot-analysis#commentsTue, 29 Nov 2005 20:17:00 +0100News teamhttps://news.typo3.com/article/typo3-swot-analysisThe TYPO3 SWOT Analysis is designed to identify the strengths, weaknesses, opportunities, and threats (SWOT) to TYPO3. The results can help to improve and further distribute TYPO3. https://news.typo3.com/article/htmlarea-100https://news.typo3.com/article/htmlarea-100#commentsTue, 29 Nov 2005 20:11:00 +0100News teamhttps://news.typo3.com/article/htmlarea-100 https://news.typo3.com/article/t3n-magazine-02-2005https://news.typo3.com/article/t3n-magazine-02-2005#commentsWed, 23 Nov 2005 07:32:00 +0100News teamhttps://news.typo3.com/article/t3n-magazine-02-2005The latest issue of the German-language T3N Magazine (02/2005) can now be ordered. The reader can expect a wide spectrum of interesting articles about TYPO3 and other open source technologies. https://news.typo3.com/article/announcing-the-news-teamhttps://news.typo3.com/article/announcing-the-news-team#commentsFri, 18 Nov 2005 19:38:00 +0100Thomas Hempelhttps://news.typo3.com/article/announcing-the-news-team https://news.typo3.com/article/typo3-381-releasedhttps://news.typo3.com/article/typo3-381-released#commentsMon, 14 Nov 2005 10:18:00 +0100Michael Stuckihttps://news.typo3.com/article/typo3-381-released https://news.typo3.com/security/advisory/security-bulletins-important-security-enhancements-in-typo3-381https://news.typo3.com/security/advisory/security-bulletins-important-security-enhancements-in-typo3-381#commentsMon, 14 Nov 2005 10:17:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/security-bulletins-important-security-enhancements-in-typo3-381Multiple TYPO3 Security Bulletins have been issued, all of which are addressed by the release of TYPO3 3.8.1. https://news.typo3.com/security/advisory/typo3-20051114-7https://news.typo3.com/security/advisory/typo3-20051114-7#commentsMon, 14 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051114-7Situations are imaginable where sensitive information gets stored in the fileadmin/_temp_/ directory. If misconfigured in your web server, this directory can be browsable and therefore expose that information. https://news.typo3.com/security/advisory/typo3-20051114-6https://news.typo3.com/security/advisory/typo3-20051114-6#commentsMon, 14 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051114-6 Under special circumstances, setting config.baseURL (see typo3.org/documentation/document-library/doc_core_tsref/quot_CONFIG_quot/ ) to a numeric value ("1") could be used to spoof a malicious baseURL into your TYPO3 cache. It has now been decided to technically prevent this misconfiguration. https://news.typo3.com/security/advisory/typo3-20051114-5https://news.typo3.com/security/advisory/typo3-20051114-5#commentsMon, 14 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051114-5For convenience, the TYPO3 Install Tool provides a button sets the "encryptionKey" to a random value. It has been observed that only parts of the generated value are actually random. The overall key is therefore unique and -as of today- considered sufficiently secure. However, the effective key length is not the intended one. https://news.typo3.com/security/advisory/typo3-20051114-4https://news.typo3.com/security/advisory/typo3-20051114-4#commentsMon, 14 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051114-4In the past, a "Shift Reload" from the browser (AKA a GET request with the "no-cache" pragma set) cleared the TYPO3 cache of the requested page. This may be considered a potential target for Denial of Service attacks. https://news.typo3.com/security/advisory/typo3-20051114-3https://news.typo3.com/security/advisory/typo3-20051114-3#commentsMon, 14 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051114-3Various security issues have been reported for PhpMyAdmin (see www.securityfocus.com/bid/15196 for details.) https://news.typo3.com/security/advisory/typo3-20051114-2https://news.typo3.com/security/advisory/typo3-20051114-2#commentsMon, 14 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051114-2A Cross Site Scripting issue has been found in showpic.php. https://news.typo3.com/security/advisory/typo3-20051114-1https://news.typo3.com/security/advisory/typo3-20051114-1#commentsMon, 14 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051114-1The file editor functionality in the TYPO3 Install Tool (menu option "Edit files in typo3conf/") has an option that reads "Make backup copy". If set, this will create a backup copy and append a "~" to the original file name. This leads to file names that may be delivered as text files by a web server. Thus, sensitive information (e.g. the content of localconf.php) may be disclosed. https://news.typo3.com/article/new-logo-and-guidelines-now-onlinehttps://news.typo3.com/article/new-logo-and-guidelines-now-online#commentsWed, 09 Nov 2005 16:30:00 +0100Rasmus Skjoldanhttps://news.typo3.com/article/new-logo-and-guidelines-now-onlineGet prepared for the new CI to be launched on 29th. of January 2006. https://news.typo3.com/security/advisory/security-bulletins-chc-forum-th-mailformplushttps://news.typo3.com/security/advisory/security-bulletins-chc-forum-th-mailformplus#commentsMon, 07 Nov 2005 15:36:18 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/security-bulletins-chc-forum-th-mailformplusTwo security bulletins regarding the 3rd party extensions "CHC Forum" and "th_mailformplus" have been issued today. Fixed versions are available. https://news.typo3.com/security/advisory/typo3-20051107-2https://news.typo3.com/security/advisory/typo3-20051107-2#commentsMon, 07 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051107-2A weakness in the form validation of th_mailformplus has been discovered that may be abused to inject additional recipients in mail forms. https://news.typo3.com/security/advisory/typo3-20051107-1https://news.typo3.com/security/advisory/typo3-20051107-1#commentsMon, 07 Nov 2005 10:00:00 +0100Ekkehard Gümbelhttps://news.typo3.com/security/advisory/typo3-20051107-1A bug has been discovered in the "CHC Forum" (chc_forum) extension where some Javascript expressions are not properly caught when entered in forms. Thus, specially crafted entries may be used to inject malicious code.