Security Advisories
All Advisories
Follow TYPO3 security advisories as soon as they are published by subscribing to the dedicated security RSS feed.
TYPO3-EXT-SA-2015-006: Arbitrary Code Execution in extension Frontend User Upload (feupload)
It has been discovered that the extension "Frontend User Upload" (feupload) is susceptible to Arbitrary Code Execution
TYPO3-EXT-SA-2015-008: SQL Injection vulnerability in extension wt_directory (wt_directory)
It has been discovered that the extension "wt_directory" (wt_directory) is susceptible to SQL Injection
TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5
It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass.
TYPO3-PSA-2015-001: Important Security-Bulletin Pre-Announcement
A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET.
TYPO3-EXT-SA-2015-005: Cross-Site Scripting in extension Gridelements (gridelements)
It has been discovered that the extension "gridelements" (gridelements) is susceptible to Cross-Site Scripting
TYPO3-EXT-SA-2015-004: Information Disclosure in Direct Mail Subscription (direct_mail_subscription)
It has been discovered that the extension "Direct Mail Subscription" (direct_mail_subscription) is susceptible to Information Disclosure.
TYPO3-EXT-SA-2015-003: Multiple vulnerabilities in Content Rating Extbase (content_rating_extbase)
It has been discovered that the extension "Content Rating Extbase" (content_rating_extbase) is susceptible to Cross-Site Scripting and SQL Injection.
TYPO3-EXT-SA-2015-002: Multiple vulnerabilities in Content Rating (content_rating)
It has been discovered that the extension "Content Rating" (content_rating) is susceptible to Cross-Site Scripting and SQL Injection.
TYPO3-EXT-SA-2015-001: Improper Authentication in LDAP / SSO Authentication (ig_ldap_sso_auth)
It has been discovered that the extension "LDAP / SSO Authentication" (ig_ldap_sso_auth) is susceptible to Improper Authentication.
TYPO3-EXT-SA-2014-021: Cross-Site Scripting vulnerability in wfGallery (wf_gallery)
It has been discovered that the extension "wfGallery" (wf_gallery) is susceptible to Cross-Site Scripting.