.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms-core 10.4.6 vulnerabilities

128 advisories known · typo3/cms-core@10.4.6 · 61 affect this release · Dependencies not checked · showing 28 more

SEVERITYADVISORYPUBLISHED

Does not affect 10.4.6

SEVERITYADVISORYPUBLISHED

MediumBootstrap Cross-site Scripting vulnerabilityGHSA-pj7m-g53m-7638CVE-2018-14041Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗8 years ago

MediumTYPO3 CMS has Broken Access Control in its DataHandlerGHSA-qcmw-6rm2-5x78CVE-2026-47350Affected >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS has Cross-Site Scripting in Indexed SearchGHSA-cg75-qfg2-w9hjCVE-2026-47348Affected >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 is vulnerable to Mass Assignment in the Extension table administration libraryGHSA-5fj8-wh3g-qvq2CVE-2013-7080Affected >=4.5.0 <4.5.31, >=4.6.0 <4.7.16, >=6.0.0 <6.0.11Fixed in 4.5.31 Fixed in 4.7.16 Fixed in 6.0.11OSV source ↗4 years ago

MediumTYPO3 Improper Access Control vulnerabilityGHSA-r674-mc9p-hvw5CVE-2013-7081Affected >=4.5.0 <4.5.31, >=4.7.0 <4.7.16, >=6.0.0 <6.0.11, >=6.1.0 <6.1.6Fixed in 4.5.31 Fixed in 4.7.16 Fixed in 6.0.11 Fixed in 6.1.6OSV source ↗4 years ago

MediumTYPO3 Improper Access Management in the File Abstraction LayerGHSA-p9jg-9w87-6rg4CVE-2013-4320Affected >=6.0 <6.0.9, >=6.1 <6.1.4Fixed in 6.0.9 Fixed in 6.1.4OSV source ↗4 years ago

MediumTYPO3 Sensitive Information Disclosure via escapeStrForLike methodGHSA-xgc2-q928-27wvCVE-2010-5104Affected >=4.2.0 <4.2.16, >=4.3.0 <4.3.9, >=4.4.0 <4.4.5Fixed in 4.2.16 Fixed in 4.3.9 Fixed in 4.4.5OSV source ↗4 years ago

MediumTYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module GHSA-5cmc-r23m-hvrrCVE-2013-7077Affected >=6.0 <6.0.12, >=6.1 <6.1.7Fixed in 6.0.12 Fixed in 6.1.7OSV source ↗4 years ago

MediumTYPO3 API function vulnerable to Cross-site ScriptingGHSA-m7rg-85g8-28m9CVE-2009-3633Affected <=4.0.13, >=4.1.0 <4.1.13, >=4.2.0 <4.2.10, >=4.3alpha1 <4.3beta2Fixed in 4.1.13 Fixed in 4.2.10 Fixed in 4.3beta2OSV source ↗5 years ago

MediumTYPO3 Unrestricted File Upload vulnerabilityGHSA-f35p-hcwf-9f9fCVE-2008-2717Affected >=4.0.0 <4.0.9, >=4.1.0 <4.1.7, >=4.2.0 <4.2.1Fixed in 4.0.9 Fixed in 4.1.7 Fixed in 4.2.1OSV source ↗5 years ago

MediumTYPO3 CMS vulnerable to Denial of Service in Page Error HandlingGHSA-fffr-7x4x-f98qBIT-typo3-2022-36104CVE-2022-36104Affected >=11.4.0 <11.5.16Fixed in 11.5.16OSV source ↗4 years ago

MediumTYPO3 SQL Injection in low-level Query GeneratorGHSA-59pj-7mjh-4465CVE-2019-19850Affected >=10.0 <10.2.2, >=8.0 <8.7.30, >=9.0 <9.5.12Fixed in 10.2.2 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

MediumTYPO3 Information Disclosure in Backend User InterfaceGHSA-rv8r-8mh5-5376Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗2 years ago

MediumCross-Site Scripting in TYPO3 CMS Link HandlingGHSA-4j77-gg36-9864BIT-typo3-2020-11065CVE-2020-11065Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Form EngineGHSA-43gj-mj2w-wh46BIT-typo3-2020-11064CVE-2020-11064Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumTYPO3 Information Disclosure in User AuthenticationGHSA-wj85-rg5g-v8jmAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

MediumTYPO3 Disclosure of Information about Installed ExtensionsGHSA-p2h4-7fp3-cmh8Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Denial of Service in Online Media Asset HandlingGHSA-29m4-mx89-3mjgAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Install ToolGHSA-66c2-7g4p-wx4pAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Open redirect vulnerability in the Access tracking mechanism GHSA-7gxq-5qqc-v3fcCVE-2013-1843Affected >=4.5.0 <4.5.24, >=4.6.0 <4.6.17, >=4.7.0 <4.7.9, >=6.0.0 <6.0.3Fixed in 4.5.24 Fixed in 4.6.17 Fixed in 4.7.9 Fixed in 6.0.3OSV source ↗4 years ago

MediumTYPO3 is vulnerable to Information Disclosure in the HTML mailing APIGHSA-5f2f-hr23-j59jCVE-2010-3673Affected <4.2.13, >=4.3 <4.3.4, >=4.4 <4.4.1Fixed in 4.2.13 Fixed in 4.3.4 Fixed in 4.4.1OSV source ↗5 years ago

MediumHTTP Host Header InjectionGHSA-m2jh-fxw4-gphmBIT-typo3-2021-41114CVE-2021-41114Affected >=11.0.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

MediumCross-Site Scripting in ternary conditional operatorGHSA-7733-hjv6-4h47BIT-typo3-2020-15241CVE-2020-15241Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗6 years ago

MediumTYPO3 Broken Access Control in Import ModuleGHSA-g776-759r-pf6xAffected >=9.3.0 <9.5.8Fixed in 9.5.8OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Page TreeGHSA-wvvp-jwf5-qcpcAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

LowInformation Disclosure in Password ResetGHSA-347x-877p-hcwxBIT-typo3-2020-11063CVE-2020-11063Affected >=10.0.0 <10.4.2Fixed in 10.4.2OSV source ↗6 years ago

LowTYPO3 vulnerable to an HTML Injection in the History ModuleGHSA-xjwx-78x7-q6jcCVE-2024-34355Affected >=13.0.0 <13.1.1Fixed in 13.1.1OSV source ↗2 years ago

LowTYPO3 Cross-site scripting (XSS) vulnerability in the Extbase FrameworkGHSA-qj69-chjp-g4f5CVE-2013-7078Affected >=4.5.0 <4.5.31, >=4.7.0 <4.7.16, >=6.0.0 <6.0.11, >=6.1.0 <6.1.6Fixed in 4.5.31 Fixed in 4.7.16 Fixed in 6.0.11 Fixed in 6.1.6OSV source ↗4 years ago