Posts by author Lars Houmark en https://news.typo3.com/article/author/lars-houmark/blog.author.xml Fri, 24 Jul 2026 03:38:55 +0200 https://news.typo3.com/security/advisory/information-disclosure-xss-in-typo3-corehttps://news.typo3.com/security/advisory/information-disclosure-xss-in-typo3-core#commentsTue, 10 Feb 2009 10:00:00 +0100Lars Houmarkhttps://news.typo3.com/security/advisory/information-disclosure-xss-in-typo3-coreIt has been discovered that TYPO3 Core is vulnerable to Information Disclosure and Cross-Site Scripting. https://news.typo3.com/security/advisory/typo3-sa-2009-002https://news.typo3.com/security/advisory/typo3-sa-2009-002#commentsTue, 10 Feb 2009 10:00:00 +0100Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-sa-2009-002It has been discovered that TYPO3 Core is vulnerable to Information Disclosure and Cross-Site Scripting. https://news.typo3.com/security/advisory/important-security-bulletin-pre-announcementhttps://news.typo3.com/security/advisory/important-security-bulletin-pre-announcement#commentsMon, 09 Feb 2009 00:00:00 +0100Lars Houmarkhttps://news.typo3.com/security/advisory/important-security-bulletin-pre-announcementSerious security issue found in TYPO3 core. https://news.typo3.com/security/advisory/multiple-security-issues-found-in-typo3-corehttps://news.typo3.com/security/advisory/multiple-security-issues-found-in-typo3-core#commentsTue, 20 Jan 2009 17:23:00 +0100Lars Houmarkhttps://news.typo3.com/security/advisory/multiple-security-issues-found-in-typo3-coreIt has been discovered that TYPO3 Core is vulnerable to Broken Authentication and Session Management, Cross-Site Scripting, Insecure Randomness and Remote Command Execution. https://news.typo3.com/security/advisory/two-third-party-typo3-extensions-found-insecurehttps://news.typo3.com/security/advisory/two-third-party-typo3-extensions-found-insecure#commentsWed, 24 Sep 2008 09:45:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/two-third-party-typo3-extensions-found-insecureThe extensions phpMyAdmin (phpmyadmin) and freeCap CAPTCHA (sr_freecap) have been found insecure. https://news.typo3.com/security/advisory/security-bulletin-typo3-20080919-1-multiple-third-party-extensions-found-insecurehttps://news.typo3.com/security/advisory/security-bulletin-typo3-20080919-1-multiple-third-party-extensions-found-insecure#commentsFri, 19 Sep 2008 07:43:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/security-bulletin-typo3-20080919-1-multiple-third-party-extensions-found-insecureA total of 11 third party extensions have been found insecure. Please follow the links in this news item, in order to see which extensions have has been found insecure. https://news.typo3.com/security/advisory/security-bulletin-typo3-20080916-1-code-execution-vulnerability-in-extension-phpmyadmin-1https://news.typo3.com/security/advisory/security-bulletin-typo3-20080916-1-code-execution-vulnerability-in-extension-phpmyadmin-1#commentsTue, 16 Sep 2008 23:02:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/security-bulletin-typo3-20080916-1-code-execution-vulnerability-in-extension-phpmyadmin-1It has been discovered that the extension phpMyAdmin (phpmyadmin) is open for code execution. https://news.typo3.com/security/advisory/multiple-security-issues-in-third-party-typo3-extensionshttps://news.typo3.com/security/advisory/multiple-security-issues-in-third-party-typo3-extensions#commentsTue, 01 Jul 2008 07:30:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/multiple-security-issues-in-third-party-typo3-extensionsA total of 15 third party extensions has been found insecure. Please follow the links in this news item, in order to see which extensions have has been found insecure. https://news.typo3.com/security/advisory/security-bulletin-typo3-20080619-1-several-vulnerabilities-have-been-found-in-typo3-third-party-extensionshttps://news.typo3.com/security/advisory/security-bulletin-typo3-20080619-1-several-vulnerabilities-have-been-found-in-typo3-third-party-extensions#commentsThu, 19 Jun 2008 06:30:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/security-bulletin-typo3-20080619-1-several-vulnerabilities-have-been-found-in-typo3-third-party-extensionsSeveral vulnerabilities have been found in TYPO3 third party extensions. https://news.typo3.com/security/advisory/security-bulletin-typo3-20080611-1-multiple-vulnerabilities-in-typo3-corehttps://news.typo3.com/security/advisory/security-bulletin-typo3-20080611-1-multiple-vulnerabilities-in-typo3-core#commentsWed, 11 Jun 2008 11:28:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/security-bulletin-typo3-20080611-1-multiple-vulnerabilities-in-typo3-coreIt has been discovered that the default value of the TYPO3 configuration variable fileDenyPattern allows arbitrary code execution on Apache web servers. Besides that, the library fe_adminlib.inc allows Cross Site Scripting (XSS). https://news.typo3.com/security/advisory/typo3-security-bulletin-20071210-1-sql-injection-in-system-extension-indexed-searchhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20071210-1-sql-injection-in-system-extension-indexed-search#commentsMon, 10 Dec 2007 11:00:00 +0100Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20071210-1-sql-injection-in-system-extension-indexed-searchIt has been discovered that the system extension indexed_search is vulnerable to a SQL Injection flaw. https://news.typo3.com/security/advisory/typo3-security-bulletin-20070919-1-multiple-vulnerabilities-in-extension-mm-forumhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070919-1-multiple-vulnerabilities-in-extension-mm-forum#commentsWed, 19 Sep 2007 14:36:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070919-1-multiple-vulnerabilities-in-extension-mm-forumIt has been discovered that the extension mm_forum is vulnerable to multiple SQL Injection attacks and multiple XSS flaws alongside other vulnerabilities. https://news.typo3.com/security/advisory/typo3-security-bulletin-20070801-1-multiple-vulnerabilities-in-extension-ve-guestbookhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070801-1-multiple-vulnerabilities-in-extension-ve-guestbook#commentsWed, 01 Aug 2007 19:50:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070801-1-multiple-vulnerabilities-in-extension-ve-guestbookIt has been discovered that the extension ve_guestbook is vulnerable to SQL Injection attacks. Also, a Cross Site Scripting issue has been detected. https://news.typo3.com/security/advisory/typo3-security-bulletin-20070719-1-remote-shell-command-execution-in-extensions-embedding-phpmailerhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070719-1-remote-shell-command-execution-in-extensions-embedding-phpmailer#commentsThu, 19 Jul 2007 16:30:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070719-1-remote-shell-command-execution-in-extensions-embedding-phpmailerMultiple TYPO3 extensions is affected by the third party tool PHPMailer, which is vulnerable to a remote shell command execution. https://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070716-2-information-disclosure-from-extension-phpmyadminhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070716-2-information-disclosure-from-extension-phpmyadmin#commentsMon, 16 Jul 2007 23:50:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070716-2-information-disclosure-from-extension-phpmyadminAn information disclosure issue has been found in the phpmyadmin extension of TYPO3 that may give access to phpinfo() information in special cases. The standalone version of phpmyadmin is not affected. https://news.typo3.com/security/advisory/typo3-security-bulletin-20070716-1-cross-site-scripting-vulnerability-in-faqhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070716-1-cross-site-scripting-vulnerability-in-faq#commentsMon, 16 Jul 2007 13:17:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-20070716-1-cross-site-scripting-vulnerability-in-faqIt has been discovered that the extension faq is susceptible to cross site scripting (XSS) attacks, making it possible to execute arbitrary JavaScript. https://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070712-1-multiple-vulnerabilities-in-civservhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070712-1-multiple-vulnerabilities-in-civserv#commentsThu, 12 Jul 2007 12:17:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070712-1-multiple-vulnerabilities-in-civservMultiple vulnerabilities has been found. Incorrect handling of input from GET/POST-variables, and allowing an attacker to execute XSS and/or SQL Injection attacks. https://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070710-1-sql-injection-in-fechangepasswordhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070710-1-sql-injection-in-fechangepassword#commentsTue, 10 Jul 2007 20:06:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070710-1-sql-injection-in-fechangepasswordIt has been discovered that the extension fechangepassword is open for a SQL injection when updating the password. https://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070709-1-incorrect-authentication-in-ftpbrowserhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070709-1-incorrect-authentication-in-ftpbrowser#commentsMon, 09 Jul 2007 14:22:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070709-1-incorrect-authentication-in-ftpbrowserIt has been discovered that the extension ftpbrowser is doing incorrect authentication in some files, making it open for exploiting. https://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070703-1-multiple-vulnerabilities-in-all-variants-of-mysqldumperhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070703-1-multiple-vulnerabilities-in-all-variants-of-mysqldumper#commentsTue, 03 Jul 2007 23:35:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070703-1-multiple-vulnerabilities-in-all-variants-of-mysqldumperMultiple vulnerabilities have been found in the third party extension "mysqldumper". Full read/write access to the connected database and other related issues. https://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070612-1-information-disclosure-in-w4x-backuphttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070612-1-information-disclosure-in-w4x-backup#commentsTue, 12 Jun 2007 13:17:00 +0200Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070612-1-information-disclosure-in-w4x-backupIt has been discovered that the extension w4x_backup has several security related issues, which may disclosure confidential information. https://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070221-1-email-header-injectionhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070221-1-email-header-injection#commentsWed, 21 Feb 2007 05:30:00 +0100Lars Houmarkhttps://news.typo3.com/security/advisory/typo3-security-bulletin-typo3-20070221-1-email-header-injectionA problem has been discovered where the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for.