Ingrid Stürmer

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The extension fails to properly validate the expiration of a client-supplied JWT (JSON Web Token), which is a compact, URL-safe means of representing claims to be transferred between two parties. This flaw allows an attacker who possesses a valid API key to authenticate using an expired token. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation of this issue requires the attacker to already have control of the SYSSY project's API key. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.