Georg Ringer

The extension fails to properly sanitize user input before using it in a database query. This allows an unauthenticated attacker to perform SQL injection, which is the insertion of malicious SQL code into a query, through a URL parameter on pages utilizing the "Date Menu of news articles" plugin. This issue is exploitable when the "Date Menu of news articles" plugin is active and the TypoScript/Plugin setting `disableOverrideDemand` is not enabled.

The `AddressRepository::getSqlQuery()` function constructs a database query without properly sanitizing user input, which can lead to SQL Injection (a technique where malicious SQL statements are inserted into entry fields for execution). While this method is not called within the extension by default, custom extensions that invoke it using untrusted input can expose the site to this risk.

An issue was discovered in the google for jobs extension where it fails to properly encode user input for output in HTML context, leading to a potential exploit. A TYPO3 backend user account is required to exploit this issue.

The issue allows remote attackers to obtain sensitive installation environment information by reading the update check request.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components. These vulnerabilities allow remote authenticated editors to inject arbitrary web script or HTML.

The issue concerns the Content Editing Wizards component, which fails to check permissions. This allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.

The issue is related to "Insecure Unserialize" and has unknown impact with remote attack vectors.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML.

The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to obtain sensitive information. The exact vectors used for the attack are not specified.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of victims via unknown vectors.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.

The issue is related to a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors, potentially leading to unauthorized actions on the affected system.

The issue allows remote authenticated users to execute arbitrary code.

The issue is related to a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to obtain sensitive information via unspecified vectors related to improper protection of the backup output directory.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.