https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:53:04 +0000 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1097 certfr-2022-avi-1097 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1097 https://cve.radiocsirt.org/vuln/euvd-2026-232246 EUVD-2026-232246 https://cve.radiocsirt.org/vuln/euvd-2026-232246 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23504 <p>TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.</p> <p>TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-23504 https://cve.radiocsirt.org/vuln/ghsa-8w3p-qh3x-6gjr <p><strong>Affected:</strong> Packagist: typo3/cms-core, Packagist: typo3/cms</p> <p>&gt; ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.3)</p> <p>### Problem Due to the lack of handling user-submitted [YAML placeholder expressions](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Yaml/YamlApi.html#custom-placeholder-processing) in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors.</p> <p>A valid backend user account having administrator privileges is needed to exploit this vulnerability.</p> <p>### Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.</p> <p>### Credits Thanks to TYPO3 core &amp; security team member Oliver Hader who reported and fixed the issue.</p> <p>### References * [TYPO3-CORE-SA-2022-016](https://typo3.org/security/advisory/typo3-core-sa-2022-016)</p> <p><strong>Affected:</strong> Packagist: typo3/cms-core, Packagist: typo3/cms</p> <p>&gt; ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.3)</p> <p>### Problem Due to the lack of handling user-submitted [YAML placeholder expressions](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Yaml/YamlApi.html#custom-placeholder-processing) in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors.</p> <p>A valid backend user account having administrator privileges is needed to exploit this vulnerability.</p> <p>### Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.</p> <p>### Credits Thanks to TYPO3 core &amp; security team member Oliver Hader who reported and fixed the issue.</p> <p>### References * [TYPO3-CORE-SA-2022-016](https://typo3.org/security/advisory/typo3-core-sa-2022-016)</p> https://cve.radiocsirt.org/vuln/ghsa-8w3p-qh3x-6gjr https://cve.radiocsirt.org/vuln/gsd-2022-23504 gsd-2022-23504 https://cve.radiocsirt.org/vuln/gsd-2022-23504 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2299 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand herzustellen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand herzustellen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2299