GCVE - cpe:2.3:a:typo3:typo3:4.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:typo3:typo3:4.1:*:*:*:*:*:*:*

part: a version: 4.1 update: *

Vendor	Typo3 (`bebcd01c-0947-5641-89ed-9b814cca944e`)
Product	Typo3 (`e0e75c36-ce92-5448-bdce-8b59acd8c849`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/typo3/typo3`	purl2cpe	2026-06-01 10:16:08.642943
`pkg:typo3/typo3.cms.git`	purl2cpe	2026-06-01 10:16:08.642944

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3945`	vulnerable	2026-06-08 05:05:43.499188	Details available The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash. Published: 2014-06-03T14:00:00.000Z Updated: 2024-08-06T10:57:17.942Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-2942 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ http://www.openwall.com/lists/oss-security/2014/06/03/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0816`	vulnerable	2026-06-08 04:51:11.499753	Details available Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields. Published: 2009-03-05T02:00:00.000Z Updated: 2024-08-07T04:48:52.109Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2009/02/10/6 http://www.debian.org/security/2009/dsa-1720 http://www.securitytracker.com/id?1021709 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0815`	vulnerable	2026-06-08 04:51:11.491990	Details available The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request. Published: 2009-03-05T02:00:00.000Z Updated: 2024-08-07T04:48:52.184Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2009/02/10/6 http://www.debian.org/security/2009/dsa-1720 http://www.securitytracker.com/id?1021710 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2718`	vulnerable	2026-06-08 04:50:31.804921	Details available Cross-site scripting (XSS) vulnerability in fe_adminlib.inc in TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, as used in extensions such as (1) direct_mail_subscription, (2) feuser_admin, and (3) kb_md5fepw, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2008-06-16T22:00:00.000Z Updated: 2024-08-07T09:14:15.182Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/42986 http://www.securityfocus.com/bid/29657 http://secunia.com/advisories/30619 http://www.securityfocus.com/archive/1/493270/100/0/threaded http://www.debian.org/security/2008/dsa-1596	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2717`	vulnerable	2026-06-08 04:50:31.800676	Details available TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions. Published: 2008-06-16T22:00:00.000Z Updated: 2024-08-07T09:14:14.521Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/29657 http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/ http://secunia.com/advisories/30619 http://www.securityfocus.com/archive/1/493270/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/42988	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-6381`	vulnerable	2026-06-08 04:50:08.686410	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.