.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms-core 9.5.20 vulnerabilities

128 advisories known · typo3/cms-core@9.5.20 · 52 affect this release · Dependencies not checked · showing 28 more

SEVERITYADVISORYPUBLISHED

Does not affect 9.5.20

SEVERITYADVISORYPUBLISHED

MediumTYPO3 Sensitive Information Disclosure via escapeStrForLike methodGHSA-xgc2-q928-27wvCVE-2010-5104Affected >=4.2.0 <4.2.16, >=4.3.0 <4.3.9, >=4.4.0 <4.4.5Fixed in 4.2.16 Fixed in 4.3.9 Fixed in 4.4.5OSV source ↗4 years ago

MediumTYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module GHSA-5cmc-r23m-hvrrCVE-2013-7077Affected >=6.0 <6.0.12, >=6.1 <6.1.7Fixed in 6.0.12 Fixed in 6.1.7OSV source ↗4 years ago

MediumTYPO3 API function vulnerable to Cross-site ScriptingGHSA-m7rg-85g8-28m9CVE-2009-3633Affected <=4.0.13, >=4.1.0 <4.1.13, >=4.2.0 <4.2.10, >=4.3alpha1 <4.3beta2Fixed in 4.1.13 Fixed in 4.2.10 Fixed in 4.3beta2OSV source ↗5 years ago

MediumTYPO3 Unrestricted File Upload vulnerabilityGHSA-f35p-hcwf-9f9fCVE-2008-2717Affected >=4.0.0 <4.0.9, >=4.1.0 <4.1.7, >=4.2.0 <4.2.1Fixed in 4.0.9 Fixed in 4.1.7 Fixed in 4.2.1OSV source ↗5 years ago

MediumTYPO3 CMS vulnerable to Denial of Service in Page Error HandlingGHSA-fffr-7x4x-f98qBIT-typo3-2022-36104CVE-2022-36104Affected >=11.4.0 <11.5.16Fixed in 11.5.16OSV source ↗4 years ago

MediumTYPO3 SQL Injection in low-level Query GeneratorGHSA-59pj-7mjh-4465CVE-2019-19850Affected >=10.0 <10.2.2, >=8.0 <8.7.30, >=9.0 <9.5.12Fixed in 10.2.2 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

MediumTYPO3 Information Disclosure in Backend User InterfaceGHSA-rv8r-8mh5-5376Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗2 years ago

MediumTYPO3 CMS vulnerable to Insufficient Session Expiration after Password ResetGHSA-mgj2-q8wp-29rrBIT-typo3-2022-23502CVE-2022-23502Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

MediumTYPO3 CMS missing check for expiration time of password reset token for backend usersGHSA-5959-4x58-r8c2BIT-typo3-2022-36106CVE-2022-36106Affected >=10.4.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helperGHSA-fv2m-9249-qx85BIT-typo3-2022-36108CVE-2022-36108Affected >=10.3.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formGHSA-x79j-wgqv-g8h2BIT-typo3-2021-21358CVE-2021-21358Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumCross-Site Scripting in Content PreviewGHSA-fjh3-g8gq-9q92BIT-typo3-2021-21340CVE-2021-21340Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Link HandlingGHSA-4j77-gg36-9864BIT-typo3-2020-11065CVE-2020-11065Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Form EngineGHSA-43gj-mj2w-wh46BIT-typo3-2020-11064CVE-2020-11064Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumTYPO3 Information Disclosure in User AuthenticationGHSA-wj85-rg5g-v8jmAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

MediumTYPO3 Disclosure of Information about Installed ExtensionsGHSA-p2h4-7fp3-cmh8Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Denial of Service in Online Media Asset HandlingGHSA-29m4-mx89-3mjgAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Install ToolGHSA-66c2-7g4p-wx4pAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Open redirect vulnerability in the Access tracking mechanism GHSA-7gxq-5qqc-v3fcCVE-2013-1843Affected >=4.5.0 <4.5.24, >=4.6.0 <4.6.17, >=4.7.0 <4.7.9, >=6.0.0 <6.0.3Fixed in 4.5.24 Fixed in 4.6.17 Fixed in 4.7.9 Fixed in 6.0.3OSV source ↗4 years ago

MediumTYPO3 is vulnerable to Information Disclosure in the HTML mailing APIGHSA-5f2f-hr23-j59jCVE-2010-3673Affected <4.2.13, >=4.3 <4.3.4, >=4.4 <4.4.1Fixed in 4.2.13 Fixed in 4.3.4 Fixed in 4.4.1OSV source ↗5 years ago

MediumHTTP Host Header InjectionGHSA-m2jh-fxw4-gphmBIT-typo3-2021-41114CVE-2021-41114Affected >=11.0.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

MediumCross-Site Scripting in ternary conditional operatorGHSA-7733-hjv6-4h47BIT-typo3-2020-15241CVE-2020-15241Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗6 years ago

MediumTYPO3 Broken Access Control in Import ModuleGHSA-g776-759r-pf6xAffected >=9.3.0 <9.5.8Fixed in 9.5.8OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Page TreeGHSA-wvvp-jwf5-qcpcAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

LowXML External Entity in Dashboard WidgetGHSA-q9cp-mc96-m4w2BIT-typo3-2020-26229CVE-2020-26229Affected >=10.0.0 <10.4.10Fixed in 10.4.10OSV source ↗6 years ago

LowInformation Disclosure in Password ResetGHSA-347x-877p-hcwxBIT-typo3-2020-11063CVE-2020-11063Affected >=10.0.0 <10.4.2Fixed in 10.4.2OSV source ↗6 years ago

LowTYPO3 vulnerable to an HTML Injection in the History ModuleGHSA-xjwx-78x7-q6jcCVE-2024-34355Affected >=13.0.0 <13.1.1Fixed in 13.1.1OSV source ↗2 years ago

LowTYPO3 Cross-site scripting (XSS) vulnerability in the Extbase FrameworkGHSA-qj69-chjp-g4f5CVE-2013-7078Affected >=4.5.0 <4.5.31, >=4.7.0 <4.7.16, >=6.0.0 <6.0.11, >=6.1.0 <6.1.6Fixed in 4.5.31 Fixed in 4.7.16 Fixed in 6.0.11 Fixed in 6.1.6OSV source ↗4 years ago