.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms-core 8.7.27 vulnerabilities

128 advisories known · typo3/cms-core@8.7.27 · 40 affect this release · Dependencies not checked · showing 28 more

SEVERITYADVISORYPUBLISHED

Does not affect 8.7.27

SEVERITYADVISORYPUBLISHED

MediumTYPO3 CMS vulnerable to Insufficient Session Expiration after Password ResetGHSA-mgj2-q8wp-29rrBIT-typo3-2022-23502CVE-2022-23502Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

MediumTYPO3 CMS missing check for expiration time of password reset token for backend usersGHSA-5959-4x58-r8c2BIT-typo3-2022-36106CVE-2022-36106Affected >=10.4.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helperGHSA-fv2m-9249-qx85BIT-typo3-2022-36108CVE-2022-36108Affected >=10.3.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3's Frontend Login MailerGHSA-h4mx-xv96-2jgmBIT-typo3-2022-31049CVE-2022-31049Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 9.5.35OSV source ↗4 years ago

MediumCross-Site Scripting in Content Preview (CType menu)GHSA-x7hc-x7fm-f7qhBIT-typo3-2021-21370CVE-2021-21370Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formGHSA-x79j-wgqv-g8h2BIT-typo3-2021-21358CVE-2021-21358Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumCross-Site Scripting in Content PreviewGHSA-fjh3-g8gq-9q92BIT-typo3-2021-21340CVE-2021-21340Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Link HandlingGHSA-4j77-gg36-9864BIT-typo3-2020-11065CVE-2020-11065Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Form EngineGHSA-43gj-mj2w-wh46BIT-typo3-2020-11064CVE-2020-11064Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumTYPO3 Information Disclosure in User AuthenticationGHSA-wj85-rg5g-v8jmAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

MediumTYPO3 Disclosure of Information about Installed ExtensionsGHSA-p2h4-7fp3-cmh8Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Denial of Service in Online Media Asset HandlingGHSA-29m4-mx89-3mjgAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Install ToolGHSA-66c2-7g4p-wx4pAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllerGHSA-36g8-62qv-5957CVE-2024-34358Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45 Fixed in 11.5.37 Fixed in 12.4.15 Fixed in 13.1.1 Fixed in 9.5.48OSV source ↗2 years ago

MediumTYPO3 Open redirect vulnerability in the Access tracking mechanism GHSA-7gxq-5qqc-v3fcCVE-2013-1843Affected >=4.5.0 <4.5.24, >=4.6.0 <4.6.17, >=4.7.0 <4.7.9, >=6.0.0 <6.0.3Fixed in 4.5.24 Fixed in 4.6.17 Fixed in 4.7.9 Fixed in 6.0.3OSV source ↗4 years ago

MediumTYPO3 is vulnerable to Information Disclosure in the HTML mailing APIGHSA-5f2f-hr23-j59jCVE-2010-3673Affected <4.2.13, >=4.3 <4.3.4, >=4.4 <4.4.1Fixed in 4.2.13 Fixed in 4.3.4 Fixed in 4.4.1OSV source ↗5 years ago

MediumTYPO3 Potential Open Redirect via Parsing DifferencesGHSA-2fx5-pggv-6jjrCVE-2024-55892Affected >=10.0.0 <10.4.48, >=11.0.0 <11.5.42, >=12.0.0 <12.4.25, >=13.0.0 <13.4.3, >=9.0.0 <9.5.49Fixed in 10.4.48 Fixed in 11.5.42 Fixed in 12.4.25 Fixed in 13.4.3 Fixed in 9.5.49OSV source ↗2 years ago

MediumHTTP Host Header InjectionGHSA-m2jh-fxw4-gphmBIT-typo3-2021-41114CVE-2021-41114Affected >=11.0.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

MediumCross-Site Scripting in ternary conditional operatorGHSA-7733-hjv6-4h47BIT-typo3-2020-15241CVE-2020-15241Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗6 years ago

MediumTYPO3 Broken Access Control in Import ModuleGHSA-g776-759r-pf6xAffected >=9.3.0 <9.5.8Fixed in 9.5.8OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Page TreeGHSA-wvvp-jwf5-qcpcAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

LowTYPO3 Unverified Password Change for Backend UsersGHSA-3jrg-97f3-rqh9CVE-2025-47938Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12 Fixed in 9.5.51OSV source ↗last year

LowTYPO3 Allows Information Disclosure via DBAL Restriction HandlingGHSA-x8pv-fgxp-8v3xCVE-2025-47937Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12 Fixed in 9.5.51OSV source ↗last year

LowInformation Disclosure due to Out-of-scope Site ResolutionGHSA-jq6g-4v5m-wm9rBIT-typo3-2023-38499CVE-2023-38499Affected >=10.0.0 <10.4.39, >=11.0.0 <11.5.30, >=12.0.0 <12.4.4, >=9.4.0 <9.5.42Fixed in 10.4.39 Fixed in 11.5.30 Fixed in 12.4.4 Fixed in 9.5.42OSV source ↗3 years ago

LowXML External Entity in Dashboard WidgetGHSA-q9cp-mc96-m4w2BIT-typo3-2020-26229CVE-2020-26229Affected >=10.0.0 <10.4.10Fixed in 10.4.10OSV source ↗6 years ago

LowInformation Disclosure in Password ResetGHSA-347x-877p-hcwxBIT-typo3-2020-11063CVE-2020-11063Affected >=10.0.0 <10.4.2Fixed in 10.4.2OSV source ↗6 years ago

LowTYPO3 vulnerable to an HTML Injection in the History ModuleGHSA-xjwx-78x7-q6jcCVE-2024-34355Affected >=13.0.0 <13.1.1Fixed in 13.1.1OSV source ↗2 years ago

LowTYPO3 Cross-site scripting (XSS) vulnerability in the Extbase FrameworkGHSA-qj69-chjp-g4f5CVE-2013-7078Affected >=4.5.0 <4.5.31, >=4.7.0 <4.7.16, >=6.0.0 <6.0.11, >=6.1.0 <6.1.6Fixed in 4.5.31 Fixed in 4.7.16 Fixed in 6.0.11 Fixed in 6.1.6OSV source ↗4 years ago