|
|
| |
|
| |
typo3-src: multiple vulnerabilities
| Package(s): | typo3-src |
CVE #(s): | CVE-2012-3527
CVE-2012-3528
CVE-2012-3529
CVE-2012-3530
CVE-2012-3531
|
| Created: | August 31, 2012 |
Updated: | September 6, 2012 |
| Description: |
From the Debian advisory:
CVE-2012-3527:
An insecure call to unserialize in the help system enables
arbitrary code execution by authenticated users.
CVE-2012-3528:
The TYPO3 backend contains several cross-site scripting
vulnerabilities.
CVE-2012-3529:
Authenticated users who can access the configuration module
can obtain the encryption key, allowing them to escalate their
privileges.
CVE-2012-3530:
The RemoveXSS HTML sanitizer did not remove several HTML5
JavaScript, thus failing to mitigate the impact of cross-site
scripting vulnerabilities. |
| Alerts: |
|
( Log in to post comments)
|
|
|