Posts by author Helmut Hummel en https://news.typo3.com/article/author/helmut-hummel/blog.author.xml Fri, 24 Jul 2026 03:33:28 +0200 https://news.typo3.com/security/advisory/typo3-core-sa-2016-022https://news.typo3.com/security/advisory/typo3-core-sa-2016-022#commentsTue, 13 Sep 2016 12:01:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-022It has been discovered, that TYPO3 is vulnerable to Cache Flooding https://news.typo3.com/security/advisory/typo3-ext-sa-2016-021https://news.typo3.com/security/advisory/typo3-ext-sa-2016-021#commentsThu, 08 Sep 2016 10:30:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-ext-sa-2016-021It has been discovered that the extension "Speaking URLs for TYPO3" (realurl) is susceptible to Denial of Service. https://news.typo3.com/security/advisory/typo3-core-sa-2016-020https://news.typo3.com/security/advisory/typo3-core-sa-2016-020#commentsTue, 19 Jul 2016 12:06:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-020It has been discovered, that TYPO3 ships example code of mso/idna-convert library that is vulnerable to Cross-Site Scripting https://news.typo3.com/security/advisory/typo3-core-sa-2016-019https://news.typo3.com/security/advisory/typo3-core-sa-2016-019#commentsTue, 19 Jul 2016 12:05:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-019It has been discovered, that PHP exposes the risk of Environment Variable Injection and TYPO3 is vulnerable through third party library guzzlehttp/guzzle https://news.typo3.com/security/advisory/typo3-core-sa-2016-013https://news.typo3.com/security/advisory/typo3-core-sa-2016-013#commentsTue, 24 May 2016 10:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-013It has been discovered, that TYPO3 CMS lacks an access check for Extbase actions. https://news.typo3.com/security/advisory/typo3-psa-2016-002https://news.typo3.com/security/advisory/typo3-psa-2016-002#commentsFri, 20 May 2016 11:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-psa-2016-002TYPO3 releases containing a fix for a critical vulnerability will be published Tuesday 24th of May at about 10:00 a.m. CEST (08:00 a.m. GMT). https://news.typo3.com/security/advisory/typo3-psa-2016-001https://news.typo3.com/security/advisory/typo3-psa-2016-001#commentsThu, 05 May 2016 13:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-psa-2016-001Multiple vulnerabilities in ImageMagick have been discovered, Remote Code Execution being one of them. https://news.typo3.com/security/advisory/typo3-core-sa-2016-012https://news.typo3.com/security/advisory/typo3-core-sa-2016-012#commentsTue, 12 Apr 2016 11:03:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-012It has been discovered, that TYPO3 CMS is vulnerable to Privilege Escalation. https://news.typo3.com/security/advisory/typo3-core-sa-2016-010https://news.typo3.com/security/advisory/typo3-core-sa-2016-010#commentsTue, 12 Apr 2016 11:01:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-010It has been discovered, that TYPO3 Form Component is susceptible to Arbitrary File Disclosure. https://news.typo3.com/security/advisory/typo3-core-sa-2016-009https://news.typo3.com/security/advisory/typo3-core-sa-2016-009#commentsTue, 12 Apr 2016 11:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-009It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting. https://news.typo3.com/security/advisory/typo3-core-sa-2016-004https://news.typo3.com/security/advisory/typo3-core-sa-2016-004#commentsTue, 16 Feb 2016 12:04:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-004It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting https://news.typo3.com/security/advisory/typo3-core-sa-2016-003https://news.typo3.com/security/advisory/typo3-core-sa-2016-003#commentsTue, 16 Feb 2016 12:02:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-003It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting https://news.typo3.com/security/advisory/typo3-core-sa-2016-002https://news.typo3.com/security/advisory/typo3-core-sa-2016-002#commentsTue, 16 Feb 2016 12:01:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2016-002It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting https://news.typo3.com/security/advisory/typo3-core-sa-2015-015https://news.typo3.com/security/advisory/typo3-core-sa-2015-015#commentsTue, 15 Dec 2015 12:06:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-015It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting https://news.typo3.com/security/advisory/typo3-core-sa-2015-009https://news.typo3.com/security/advisory/typo3-core-sa-2015-009#commentsTue, 08 Sep 2015 12:01:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-009It has been discovered, that TYPO3 is susceptible to Non-Persistent Cross-Site Scripting https://news.typo3.com/security/advisory/typo3-core-sa-2015-008https://news.typo3.com/security/advisory/typo3-core-sa-2015-008#commentsTue, 08 Sep 2015 12:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-008It has been discovered, that TYPO3 is susceptible to unauthenticated path disclosure. https://news.typo3.com/security/advisory/typo3-core-sa-2015-002https://news.typo3.com/security/advisory/typo3-core-sa-2015-002#commentsWed, 01 Jul 2015 14:11:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-002It has been discovered, that editors could change, create or delete metadata of files without permission. https://news.typo3.com/security/advisory/typo3-core-sa-2015-003https://news.typo3.com/security/advisory/typo3-core-sa-2015-003#commentsWed, 01 Jul 2015 14:11:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-003It has been discovered that TYPO3 is susceptible to session fixation. https://news.typo3.com/security/advisory/typo3-core-sa-2015-004https://news.typo3.com/security/advisory/typo3-core-sa-2015-004#commentsWed, 01 Jul 2015 14:11:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-004It has been discovered, that TYPO3 is vulnerable to Cross-Site Scripting. https://news.typo3.com/security/advisory/typo3-core-sa-2015-005https://news.typo3.com/security/advisory/typo3-core-sa-2015-005#commentsWed, 01 Jul 2015 14:11:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-005It has been discovered, that editors could list all files and folders in the root directory of a TYPO3 installation. https://news.typo3.com/security/advisory/typo3-core-sa-2015-006https://news.typo3.com/security/advisory/typo3-core-sa-2015-006#commentsWed, 01 Jul 2015 14:11:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-006It has been discovered, that the backend login brute force protection can be bypassed https://news.typo3.com/security/advisory/typo3-core-sa-2015-007https://news.typo3.com/security/advisory/typo3-core-sa-2015-007#commentsWed, 01 Jul 2015 14:11:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-007It has been discovered, that third party component Flowplayer Flash is vulnerable to cross-site scripting. https://news.typo3.com/article/typo3-neos-sa-2015-001https://news.typo3.com/article/typo3-neos-sa-2015-001#commentsSat, 28 Mar 2015 08:00:00 +0100Helmut Hummelhttps://news.typo3.com/article/typo3-neos-sa-2015-001It has been discovered that TYPO3 Neos is vulnerable to Privilege Escalation. https://news.typo3.com/security/advisory/typo3-core-sa-2015-001https://news.typo3.com/security/advisory/typo3-core-sa-2015-001#commentsThu, 19 Feb 2015 12:00:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2015-001It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass. https://news.typo3.com/security/advisory/typo3-psa-2015-001https://news.typo3.com/security/advisory/typo3-psa-2015-001#commentsTue, 17 Feb 2015 12:30:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-psa-2015-001A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. https://news.typo3.com/security/advisory/typo3-core-sa-2014-003https://news.typo3.com/security/advisory/typo3-core-sa-2014-003#commentsTue, 09 Dec 2014 10:00:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2014-003It has been discovered that TYPO3 CMS is vulnerable to Link Spoofing and Cache Poisoning. https://news.typo3.com/article/typo3-cms-60-end-of-life-announcementhttps://news.typo3.com/article/typo3-cms-60-end-of-life-announcement#commentsMon, 09 Jun 2014 16:22:00 +0200Helmut Hummelhttps://news.typo3.com/article/typo3-cms-60-end-of-life-announcementTYPO3 CMS 6.0.14 is the last release for the 6.0.x branch https://news.typo3.com/security/advisory/typo3-ext-sa-2014-008https://news.typo3.com/security/advisory/typo3-ext-sa-2014-008#commentsTue, 27 May 2014 11:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-ext-sa-2014-008It has been discovered that the extension "Grid Elements" (gridelements) is susceptible to Cross-Site Scripting https://news.typo3.com/security/advisory/typo3-core-sa-2014-001https://news.typo3.com/security/advisory/typo3-core-sa-2014-001#commentsThu, 22 May 2014 11:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-core-sa-2014-001It has been discovered that TYPO3 CMS is vulnerable to Cross-Site Scripting, Insecure Unserialize, Improper Session Invalidation, Authentication Bypass, Information Disclosure and Host Spoofing. https://news.typo3.com/security/advisory/typo3-ext-sa-2014-005https://news.typo3.com/security/advisory/typo3-ext-sa-2014-005#commentsWed, 12 Feb 2014 12:00:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-ext-sa-2014-005It has been discovered that the extensions "Yet Another Gallery" (yag) and "Tools for Extbase development" (pt_extbase) are susceptible to Access Bypass