FreshPorts - VuXML
This page displays vulnerability information about FreeBSD Ports.
The last vuln.xml file processed by FreshPorts is:
nothing found there
List all Vulnerabilities, by package
List all Vulnerabilities, by date
These are the vulnerabilities relating to the commit you have selected:
|eab964f8-d632-11ea-9172-4c72b94353b5||typo3 -- multiple vulnerabilities|
Typo3 Team reports:
In case an attacker manages to generate a valid cryptographic message authentication
code (HMAC-SHA1) - either by using a different existing vulnerability or in case the
internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a
TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php
which again contains the encryptionKey as well as credentials of the database management
system being used.
In case a database server is directly accessible either via internet or in a shared hosting
network, this allows to completely retrieve, manipulate or delete database contents.
This includes creating an administration user account - which can be used to trigger remote
code execution by injecting custom extensions.
It has been discovered that an internal verification mechanism can be used to generate
arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic
message authentication code (HMAC-SHA1) and can lead to various attack chains as described
|0eab001a-9708-11ec-96c9-589cfc0f81b0||typo3 -- XSS vulnerability in svg-sanitize|
The TYPO3 project reports:
The SVG sanitizer library enshrined/svg-sanitize before version
0.15.0 did not remove HTML elements wrapped in a CDATA section.
As a result, SVG content embedded in HTML (fetched as text/html)
was susceptible to cross-site scripting. Plain SVG files
(fetched as image/svg+xml) were not affected.