GCVE - cpe:2.3:a:typo3:typo3:6.1.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:typo3:typo3:6.1.9:*:*:*:*:*:*:*

part: a version: 6.1.9 update: *

Vendor	Typo3 (`bebcd01c-0947-5641-89ed-9b814cca944e`)
Product	Typo3 (`e0e75c36-ce92-5448-bdce-8b59acd8c849`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/typo3/typo3`	purl2cpe	2026-06-01 10:16:08.686761
`pkg:typo3/typo3.cms.git`	purl2cpe	2026-06-01 10:16:08.686762

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-5956`	vulnerable	2026-06-08 05:06:51.062471	Details available The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php. Published: 2015-09-16T14:00:00.000Z Updated: 2024-08-06T07:06:34.916Z Open on db.gcve.eu Reference links https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-009/ http://seclists.org/fulldisclosure/2015/Sep/57 http://www.securitytracker.com/id/1033551 http://packetstormsecurity.com/files/133551/Typo3-CMS-6.2.14-4.5.40-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/536464/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9509`	vulnerable	2026-06-08 05:06:12.072814	Details available The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page. Published: 2015-01-04T21:00:00.000Z Updated: 2024-09-17T03:13:04.483Z Open on db.gcve.eu Reference links http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9508`	vulnerable	2026-06-08 05:06:12.063174	Details available The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors. Published: 2015-01-04T21:00:00.000Z Updated: 2024-08-06T13:47:41.065Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.