Henning Pingel

**Name of the Vulnerable Software and Affected Versions** TYPO3 wt gallery extension versions 2.5.0 and earlier **Description** A directory traversal issue in the wt gallery extension for TYPO3 allows remote attackers to read arbitrary image files and determine the directory structure. **Recommendations** For versions 2.5.0 and earlier, update to a version later than 2.5.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 extension WT Gallery versions 2.6.2 and earlier **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on behalf of the user. **Recommendations** For versions 2.6.2 and earlier, update to a version later than 2.6.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 **Description** A SQL injection issue in the indexed search system extension allows remote authenticated users to execute arbitrary SQL commands. **Recommendations** For versions 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.