.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms-core 11.5.16 vulnerabilities

128 advisories known · typo3/cms-core@11.5.16 · 35 affect this release · Dependencies not checked · showing 28 more

SEVERITYADVISORYPUBLISHED

Does not affect 11.5.16

SEVERITYADVISORYPUBLISHED

MediumTYPO3 CMS missing check for expiration time of password reset token for backend usersGHSA-5959-4x58-r8c2BIT-typo3-2022-36106CVE-2022-36106Affected >=10.4.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumTYPO3 CMS Stored Cross-Site Scripting via FileDumpControllerGHSA-9c6w-55cp-5w25BIT-typo3-2022-36107CVE-2022-36107Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32 Fixed in 11.5.16 Fixed in 7.6.58 Fixed in 8.7.48 Fixed in 9.5.37OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helperGHSA-fv2m-9249-qx85BIT-typo3-2022-36108CVE-2022-36108Affected >=10.3.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3's Frontend Login MailerGHSA-h4mx-xv96-2jgmBIT-typo3-2022-31049CVE-2022-31049Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 9.5.35OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3's Form FrameworkGHSA-3r95-23jp-mhvgBIT-typo3-2022-31048CVE-2022-31048Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

MediumCross-Site Scripting in Content Preview (CType menu)GHSA-x7hc-x7fm-f7qhBIT-typo3-2021-21370CVE-2021-21370Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formGHSA-x79j-wgqv-g8h2BIT-typo3-2021-21358CVE-2021-21358Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumCross-Site Scripting in Content PreviewGHSA-fjh3-g8gq-9q92BIT-typo3-2021-21340CVE-2021-21340Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Link HandlingGHSA-4j77-gg36-9864BIT-typo3-2020-11065CVE-2020-11065Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Form EngineGHSA-43gj-mj2w-wh46BIT-typo3-2020-11064CVE-2020-11064Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumTYPO3 Information Disclosure in User AuthenticationGHSA-wj85-rg5g-v8jmAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

MediumTYPO3 Disclosure of Information about Installed ExtensionsGHSA-p2h4-7fp3-cmh8Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Denial of Service in Online Media Asset HandlingGHSA-29m4-mx89-3mjgAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Install ToolGHSA-66c2-7g4p-wx4pAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 CMS vulnerable to User Enumeration via Response TimingGHSA-m392-235j-9r7rBIT-typo3-2022-36105CVE-2022-36105Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32 Fixed in 11.5.16 Fixed in 7.6.58 Fixed in 8.7.48 Fixed in 9.5.37OSV source ↗4 years ago

MediumInsertion of Sensitive Information into Log File in typo3/cms-coreGHSA-fh99-4pgr-8j99BIT-typo3-2022-31047CVE-2022-31047Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 7.6.57 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

MediumTYPO3 Open redirect vulnerability in the Access tracking mechanism GHSA-7gxq-5qqc-v3fcCVE-2013-1843Affected >=4.5.0 <4.5.24, >=4.6.0 <4.6.17, >=4.7.0 <4.7.9, >=6.0.0 <6.0.3Fixed in 4.5.24 Fixed in 4.6.17 Fixed in 4.7.9 Fixed in 6.0.3OSV source ↗4 years ago

MediumTYPO3 is vulnerable to Information Disclosure in the HTML mailing APIGHSA-5f2f-hr23-j59jCVE-2010-3673Affected <4.2.13, >=4.3 <4.3.4, >=4.4 <4.4.1Fixed in 4.2.13 Fixed in 4.3.4 Fixed in 4.4.1OSV source ↗5 years ago

MediumInformation Disclosure in User AuthenticationGHSA-34fr-fhqr-7235BIT-typo3-2021-32767CVE-2021-32767Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=7.0.0 <7.6.52, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 7.6.52 Fixed in 8.7.41 Fixed in 9.5.28OSV source ↗5 years ago

MediumHTTP Host Header InjectionGHSA-m2jh-fxw4-gphmBIT-typo3-2021-41114CVE-2021-41114Affected >=11.0.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

MediumCross-Site Scripting in ternary conditional operatorGHSA-7733-hjv6-4h47BIT-typo3-2020-15241CVE-2020-15241Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗6 years ago

MediumTYPO3 Broken Access Control in Import ModuleGHSA-g776-759r-pf6xAffected >=9.3.0 <9.5.8Fixed in 9.5.8OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Page TreeGHSA-wvvp-jwf5-qcpcAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

MediumInformation Disclosure via Export ModuleGHSA-8gmv-9hwg-w89gBIT-typo3-2022-31046CVE-2022-31046Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 7.6.57 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

LowXML External Entity in Dashboard WidgetGHSA-q9cp-mc96-m4w2BIT-typo3-2020-26229CVE-2020-26229Affected >=10.0.0 <10.4.10Fixed in 10.4.10OSV source ↗6 years ago

LowInformation Disclosure in Password ResetGHSA-347x-877p-hcwxBIT-typo3-2020-11063CVE-2020-11063Affected >=10.0.0 <10.4.2Fixed in 10.4.2OSV source ↗6 years ago

LowTYPO3 vulnerable to an HTML Injection in the History ModuleGHSA-xjwx-78x7-q6jcCVE-2024-34355Affected >=13.0.0 <13.1.1Fixed in 13.1.1OSV source ↗2 years ago

LowTYPO3 Cross-site scripting (XSS) vulnerability in the Extbase FrameworkGHSA-qj69-chjp-g4f5CVE-2013-7078Affected >=4.5.0 <4.5.31, >=4.7.0 <4.7.16, >=6.0.0 <6.0.11, >=6.1.0 <6.1.6Fixed in 4.5.31 Fixed in 4.7.16 Fixed in 6.0.11 Fixed in 6.1.6OSV source ↗4 years ago