Georg Ringer

**Name of the Vulnerable Software and Affected Versions** News system (news) (affected versions not specified) **Description** The extension fails to properly sanitize user input before using it in a database query. This allows an unauthenticated attacker to perform SQL injection, which is the insertion of malicious SQL code into a query, through a URL parameter on pages utilizing the "Date Menu of news articles" plugin. This issue is exploitable when the "Date Menu of news articles" plugin is active and the TypoScript/Plugin setting `disableOverrideDemand` is not enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Enable the TypoScript/Plugin setting `disableOverrideDemand` to mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Address List (tt address) (affected versions not specified) **Description** The `AddressRepository::getSqlQuery()` function constructs a database query without properly sanitizing user input, which can lead to SQL Injection (a technique where malicious SQL statements are inserted into entry fields for execution). While this method is not called within the extension by default, custom extensions that invoke it using untrusted input can expose the site to this risk. **Recommendations** As a temporary workaround, avoid calling the `getSqlQuery()` function with untrusted input in custom extensions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** google for jobs extension versions prior to 1.5.1 google for jobs extension versions 2.x prior to 2.1.1 **Description** An issue was discovered in the google for jobs extension where it fails to properly encode user input for output in HTML context, leading to a potential exploit. A TYPO3 backend user account is required to exploit this issue. **Recommendations** For versions prior to 1.5.1, update to version 1.5.1 or later. For versions 2.x prior to 2.1.1, update to version 2.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** TYPO3 extension 'Dynamic Content Elements (dce)' versions prior to 0.11.5 **Description** The issue allows remote attackers to obtain sensitive installation environment information by reading the update check request. **Recommendations** For versions prior to 0.11.5, update to version 0.11.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 6.2.x through 6.2.15 TYPO3 versions 7.x through 7.5 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components. These vulnerabilities allow remote authenticated editors to inject arbitrary web script or HTML. **Recommendations** For TYPO3 versions 6.2.x through 6.2.15, update to version 6.2.16 or later. For TYPO3 versions 7.x through 7.5, update to version 7.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.5.0 through 4.5.31 TYPO3 versions 4.7.0 through 4.7.16 TYPO3 versions 6.0.0 through 6.0.11 TYPO3 versions 6.1.0 through 6.1.6 **Description** The issue concerns the Content Editing Wizards component, which fails to check permissions. This allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters. **Recommendations** For versions 4.5.0 through 4.5.31, update to a version that includes the necessary permission checks. For versions 4.7.0 through 4.7.16, update to a version that includes the necessary permission checks. For versions 6.0.0 through 6.0.11, update to a version that includes the necessary permission checks. For versions 6.1.0 through 6.1.6, update to a version that includes the necessary permission checks.

**Name of the Vulnerable Software and Affected Versions** Apache Solr for TYPO3 (solr) extension versions prior to 2.8.3 **Description** The issue is related to "Insecure Unserialize" and has unknown impact with remote attack vectors. **Recommendations** For versions prior to 2.8.3, update to version 2.8.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 Javascript and CSS Optimizer extension versions prior to 1.1.14 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions prior to 1.1.14, update to version 1.1.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.5.x through 4.5.18 TYPO3 versions 4.6.x through 4.6.11 TYPO3 versions 4.7.x through 4.7.3 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions 4.5.x through 4.5.18, update to version 4.5.19 or later. For versions 4.6.x through 4.6.11, update to version 4.6.12 or later. For versions 4.7.x through 4.7.3, update to version 4.7.4 or later.

**Name of the Vulnerable Software and Affected Versions** bc post2facebook extension versions prior to 0.2.2 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions prior to 0.2.2, update to version 0.2.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 beuserswitch extension version 0.0.1 **Description** The issue allows remote attackers to obtain sensitive information. The exact vectors used for the attack are not specified. **Recommendations** For version 0.0.1 of the beuserswitch extension, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Terminal PHP Shell (terminal) extension versions 0.3.2 and earlier for TYPO3 **Description** A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of victims via unknown vectors. **Recommendations** For Terminal PHP Shell (terminal) extension versions 0.3.2 and earlier, update to a version later than 0.3.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 UrlTool (aeurltool) extension version 0.1.0 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. **Recommendations** For UrlTool (aeurltool) extension version 0.1.0, update to a version that fixes this issue, as using outdated versions may pose a risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Euro Calculator (skt eurocalc) extension version 0.0.1 **Description** The issue is related to a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors, potentially leading to unauthorized actions on the affected system. **Recommendations** For Euro Calculator (skt eurocalc) extension version 0.0.1, consider disabling the extension until a patch is available to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** typo3 webservice extension versions prior to 0.3.8 **Description** The issue allows remote authenticated users to execute arbitrary code. **Recommendations** For versions prior to 0.3.8, update to version 0.3.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Yet another Google search (ya googlesearch) extension versions prior to 0.3.10 for TYPO3 **Description** The issue is related to a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors. **Recommendations** For versions prior to 0.3.10, update to version 0.3.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 White Papers (mm whtppr) extension version 0.0.4 and earlier **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands. **Recommendations** For versions 0.0.4 and earlier, update to a version later than 0.0.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 Category-System (toi category) extension version 0.6.0 and earlier **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions 0.6.0 and earlier, update to a version later than 0.6.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** System Utilities (sysutils) extension versions 1.0.3 and earlier for TYPO3 **Description** The issue allows remote attackers to obtain sensitive information via unspecified vectors related to improper protection of the backup output directory. **Recommendations** For versions 1.0.3 and earlier, update to a version later than 1.0.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 extension 'Documents download (rtg files)' versions prior to 1.5.2 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue.