Georg Ringer

يفشل المكون الإضافي في تنقية مدخلات المستخدم بشكل صحيح قبل استخدامها في استعلام قاعدة البيانات. وهذا يسمح لمهاجم غير مصدق الهوية بتنفيذ «حقن SQL»، وهو إدراج كود SQL ضار في استعلام، من خلال معلمة URL في الصفحات التي تستخدم المكون الإضافي «قائمة تواريخ مقالات الأخبار». يمكن استغلال هذه الثغرة عندما يكون المكون الإضافي «قائمة تواريخ المقالات الإخبارية» نشطًا ولم يتم تمكين الإعداد `disableOverrideDemand` في TypoScript/Plugin.

تقوم الدالة `AddressRepository::getSqlQuery()` بإنشاء استعلام قاعدة بيانات دون تنقية مدخلات المستخدم بشكل صحيح، مما قد يؤدي إلى حدوث «حقن SQL» (وهي تقنية يتم من خلالها إدراج عبارات SQL ضارة في حقول الإدخال لتنفيذها). على الرغم من أن هذه الدالة لا يتم استدعاؤها داخل الملحق بشكل افتراضي، إلا أن الملحقات المخصصة التي تستدعيها باستخدام مدخلات غير موثوق بها قد تعرض الموقع لهذا الخطر.

An issue was discovered in the google for jobs extension where it fails to properly encode user input for output in HTML context, leading to a potential exploit. A TYPO3 backend user account is required to exploit this issue.

The issue allows remote attackers to obtain sensitive installation environment information by reading the update check request.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components. These vulnerabilities allow remote authenticated editors to inject arbitrary web script or HTML.

The issue concerns the Content Editing Wizards component, which fails to check permissions. This allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.

The issue is related to "Insecure Unserialize" and has unknown impact with remote attack vectors.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML.

The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to obtain sensitive information. The exact vectors used for the attack are not specified.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of victims via unknown vectors.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.

The issue is related to a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors, potentially leading to unauthorized actions on the affected system.

The issue allows remote authenticated users to execute arbitrary code.

The issue is related to a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to obtain sensitive information via unspecified vectors related to improper protection of the backup output directory.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.