.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms 10.4.6 vulnerabilities

188 advisories known · typo3/cms@10.4.6 · 34 affect this release · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Affects 10.4.6

SEVERITYADVISORYPUBLISHED

HighTYPO3 is vulnerable to Cross-Site Scripting via frontend renderingGHSA-r4f8-f93x-5qh3BIT-typo3-2023-24814CVE-2023-24814Affected >=10.0.0 <10.4.35, >=11.0.0 <11.5.23, >=12.0.0 <12.2.0Fixed in 10.4.35 Fixed in 11.5.23 Fixed in 12.2.0OSV source ↗4 years ago

HighUnrestricted File Upload in Form FrameworkGHSA-2r6j-862c-m2v2BIT-typo3-2021-21355CVE-2021-21355Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

HighBroken Access Control in Form FrameworkGHSA-3vg7-jw9m-pc3fBIT-typo3-2021-21357CVE-2021-21357Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

HighCleartext storage of session identifierGHSA-954j-f27r-cj52BIT-typo3-2020-26228CVE-2020-26228Affected >=10.0.0 <10.4.10, >=8.7.0 <8.7.38, >=9.0.0 <9.5.23Fixed in 10.4.10 Fixed in 8.7.38 Fixed in 9.5.23OSV source ↗6 years ago

HighTYPO3 CMS vulnerable to Arbitrary Code Execution via Form FrameworkGHSA-c5wx-6c2c-f7rmBIT-typo3-2022-23503CVE-2022-23503Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

MediumCross-Site Scripting in Backend Grid ViewGHSA-rgcg-28xm-8mmwBIT-typo3-2021-32669CVE-2021-32669Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 9.5.28OSV source ↗5 years ago

MediumCross-Site Scripting in Query Generator & Query ViewGHSA-6mh3-j5r5-2379BIT-typo3-2021-32668CVE-2021-32668Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 9.5.28OSV source ↗5 years ago

MediumCross-Site Scripting in Page PreviewGHSA-8mq9-fqv8-59wfBIT-typo3-2021-32667CVE-2021-32667Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 9.5.28OSV source ↗5 years ago

MediumTYPO3 HTML Sanitizer vulnerable to Cross-Site ScriptingGHSA-hvwx-qh2h-xcfjCVE-2022-23499Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

MediumTYPO3 HTML Sanitizer Bypasses Cross-Site Scripting ProtectionGHSA-47m6-46mj-p235CVE-2022-36020Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumCross-Site Scripting via Rich-Text ContentGHSA-c5c9-8c6m-727vBIT-typo3-2021-32768CVE-2021-32768Affected >=10.0.0 <10.4.19, >=11.0.0 <11.3.2, >=7.0.0 <7.6.53, >=8.0.0 <8.7.42, >=9.0.0 <9.5.29Fixed in 10.4.19 Fixed in 11.3.2 Fixed in 7.6.53 Fixed in 8.7.42 Fixed in 9.5.29OSV source ↗5 years ago

MediumOpen Redirection in Login HandlingGHSA-4jhw-2p6j-5wmpBIT-typo3-2021-21338CVE-2021-21338Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumCross-Site Scripting in Fluid view helpersGHSA-vqqx-jw6p-q3rfBIT-typo3-2020-26227CVE-2020-26227Affected >=10.0.0 <10.4.10, >=8.7.0 <8.7.38, >=9.0.0 <9.5.23Fixed in 10.4.10 Fixed in 8.7.38 Fixed in 9.5.23OSV source ↗6 years ago

MediumInsufficient Session Expiration in TYPO3's Admin ToolGHSA-wwjw-r3gj-39fqBIT-typo3-2022-31050CVE-2022-31050Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11Fixed in 10.4.29 Fixed in 11.5.11OSV source ↗4 years ago

MediumTypo3 Backend XSS VulnerabilityGHSA-jg55-3q6h-2ccfCVE-2009-0816Affected >=3.3.0Fixed in 4.0.12 Fixed in 4.1.10 Fixed in 4.2.6OSV source ↗5 years ago

MediumTYPO3 CMS vulnerable to Weak Authentication in Frontend LoginGHSA-jfp7-79g7-89rfBIT-typo3-2022-23501CVE-2022-23501Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Denial of Service in Page Error HandlingGHSA-8c28-5mp7-v24hBIT-typo3-2022-23500CVE-2022-23500Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20Fixed in 10.4.33 Fixed in 11.5.20OSV source ↗4 years ago

MediumDenial of Service in Page Error HandlingGHSA-4p9g-qgx9-397pBIT-typo3-2021-21359CVE-2021-21359Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumCleartext storage of session identifierGHSA-qx3w-4864-94chBIT-typo3-2021-21339CVE-2021-21339Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumTYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site ConfigurationGHSA-8w3p-qh3x-6gjrBIT-typo3-2022-23504CVE-2022-23504Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Insufficient Session Expiration after Password ResetGHSA-mgj2-q8wp-29rrBIT-typo3-2022-23502CVE-2022-23502Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

MediumTYPO3 CMS missing check for expiration time of password reset token for backend usersGHSA-5959-4x58-r8c2BIT-typo3-2022-36106CVE-2022-36106Affected >=10.4.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumTYPO3 CMS Stored Cross-Site Scripting via FileDumpControllerGHSA-9c6w-55cp-5w25BIT-typo3-2022-36107CVE-2022-36107Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helperGHSA-fv2m-9249-qx85BIT-typo3-2022-36108CVE-2022-36108Affected >=10.3.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3's Frontend Login MailerGHSA-h4mx-xv96-2jgmBIT-typo3-2022-31049CVE-2022-31049Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11Fixed in 10.4.29 Fixed in 11.5.11OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3's Form FrameworkGHSA-3r95-23jp-mhvgBIT-typo3-2022-31048CVE-2022-31048Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11Fixed in 10.4.29 Fixed in 11.5.11OSV source ↗4 years ago

MediumCross-Site Scripting in Content Preview (CType menu)GHSA-x7hc-x7fm-f7qhBIT-typo3-2021-21370CVE-2021-21370Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formGHSA-x79j-wgqv-g8h2BIT-typo3-2021-21358CVE-2021-21358Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumCross-Site Scripting in Content PreviewGHSA-fjh3-g8gq-9q92BIT-typo3-2021-21340CVE-2021-21340Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14 Fixed in 11.1.1OSV source ↗6 years ago

MediumTYPO3 CMS vulnerable to User Enumeration via Response TimingGHSA-m392-235j-9r7rBIT-typo3-2022-36105CVE-2022-36105Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumInsertion of Sensitive Information into Log File in typo3/cms-coreGHSA-fh99-4pgr-8j99BIT-typo3-2022-31047CVE-2022-31047Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11Fixed in 10.4.29 Fixed in 11.5.11OSV source ↗4 years ago

MediumInformation Disclosure in User AuthenticationGHSA-34fr-fhqr-7235BIT-typo3-2021-32767CVE-2021-32767Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 9.5.28OSV source ↗5 years ago

MediumInformation Disclosure via Export ModuleGHSA-8gmv-9hwg-w89gBIT-typo3-2022-31046CVE-2022-31046Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11Fixed in 10.4.29 Fixed in 11.5.11OSV source ↗4 years ago

LowXML External Entity in Dashboard WidgetGHSA-q9cp-mc96-m4w2BIT-typo3-2020-26229CVE-2020-26229Affected >=10.0.0 <10.4.10Fixed in 10.4.10OSV source ↗6 years ago

Does not affect 10.4.6

SEVERITYADVISORYPUBLISHED

CriticalArbitrary Code Execution in TYPO3 CMSGHSA-67wg-6j7r-mqh8Affected >=7.6.0 <7.6.22, >=8.0.0 <8.7.5Fixed in 7.6.22 Fixed in 8.7.5OSV source ↗2 years ago

CriticalTYPO3 vulnerable to Insufficient Session ExpirationGHSA-53mm-hx32-6475CVE-2022-47406Affected <2.0.5, >=3.0.0 <3.0.3Fixed in 2.0.5 Fixed in 3.0.3OSV source ↗4 years ago

CriticalTypo3 SQL injection due to faulty prepared statementsGHSA-gx4p-6w86-f8jxCVE-2011-3583Affected >=4.5.0 <=4.5.5OSV source ↗5 years ago

CriticalTypo3 Authentication BypassGHSA-79gv-5cgx-x6rxCVE-2011-4628Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

CriticalTYPO3 vulnerable to authentication bypass via leveraging knowledge of password hashGHSA-h7wf-jg4f-x2wcCVE-2014-3945Affected <6.2.0Fixed in 6.2.0OSV source ↗4 years ago

CriticalMissing Access Check in TYPO3 CMSGHSA-gwfx-p7mr-f92vAffected >=6.2.0 <6.2.25, >=7.6.0 <7.6.8, >=8.0.0 <8.1.1Fixed in 6.2.25 Fixed in 7.6.8 Fixed in 8.1.1OSV source ↗2 years ago

HighTYPO3 Arbitrary Code Execution via File List ModuleGHSA-8h4m-r4wm-xj7rAffected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

HighPrivilege Escalation & SQL Injection in TYPO3 CMSGHSA-7qwg-fcpw-xg5gAffected >=8.5.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighTYPO3 may allow editors to change, create, or delete metadata of files not within their file mountsGHSA-4r76-xr68-w7m7Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

HighTYPO3 Vulnerable to Insecure DeserializationGHSA-86hp-xrhj-fhpqCVE-2019-12747Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗4 years ago

HighTYPO3 Insecure Deserialization in Query Generator & Query ViewGHSA-rcgc-4xfc-564vCVE-2019-19849Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

HighTYPO3 Arbitrary Code ExecutionGHSA-fh4q-hxrw-cjqqCVE-2017-14251Affected >=7.6.0 <7.6.22, >=8.0.0 <8.7.5Fixed in 7.6.22 Fixed in 8.7.5OSV source ↗4 years ago

HighCross-Site-Request-Forgery in BackendGHSA-657m-v5vm-f6rwBIT-typo3-2021-41113CVE-2021-41113Affected >=11.2.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

HighMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSGHSA-m5vr-3m74-jwxpBIT-typo3-2020-15098CVE-2020-15098Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6 Fixed in 9.5.20OSV source ↗6 years ago

HighInsecure Deserialization in Backend User Settings in TYPO3 CMSGHSA-2wj9-434x-9hvpBIT-typo3-2020-11067CVE-2020-11067Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighClass destructors causing side-effects when being unserialized in TYPO3 CMSGHSA-2rxh-h6h9-qrqcBIT-typo3-2020-11066CVE-2020-11066Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighTYPO3 Security Misconfiguration in Install Tool CookieGHSA-f777-f784-36gmAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

HighTYPO3 CMS Possible Insecure Deserialization in Extbase Request HandlingGHSA-hh95-5xm5-v8v7Affected >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

HighTYPO3 Arbitrary Shell Execution in Swiftmailer libraryGHSA-45xg-4w5x-j429Affected >=4.5.0 <4.5.37, >=4.7.0 <4.7.20, >=6.1.0 <6.1.12, >=6.2.0 <6.2.6Fixed in 4.5.37 Fixed in 4.7.20 Fixed in 6.1.12 Fixed in 6.2.6OSV source ↗2 years ago

HighExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSGHSA-3x94-fv5h-5q2cBIT-typo3-2020-15099CVE-2020-15099Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6 Fixed in 9.5.20OSV source ↗6 years ago

HighInsecure Deserialization & Arbitrary Code Execution in TYPO3 CMSGHSA-ppgf-8745-8pgxAffected >=7.0.0 <7.6.30, >=8.0.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 7.6.30 Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighTYPO3 Remote Code Execution in third party library swiftmailerGHSA-g4pf-3jvq-2gcwAffected >=6.2.0 <6.2.30, >=7.6.0 <7.6.15, >=8.0.0 <8.5.1Fixed in 6.2.30 Fixed in 7.6.15 Fixed in 8.5.1OSV source ↗2 years ago

HighInsecure Deserialization in TYPO3 CMSGHSA-8h28-f46f-m87hAffected >=8.5.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighXML External Entity (XXE) Processing in TYPO3 CoreGHSA-qffc-gwpp-m2xrAffected >=6.2.0 <6.2.19, >=7.6.0 <7.6.4Fixed in 6.2.19 Fixed in 7.6.4OSV source ↗2 years ago

HighTYPO3 SQL Injection in dbalGHSA-9895-53fc-98v2Affected >=6.2.0 <6.2.18Fixed in 6.2.18OSV source ↗2 years ago

HighTYPO3 possible cache poisoning on the homepage when anchors are usedGHSA-p84g-j2gh-83g3Affected >=6.2.0 <6.2.9, >=7.0.0 <7.0.2Fixed in 6.2.9 Fixed in 7.0.2OSV source ↗2 years ago

HighTYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanismGHSA-w736-qv86-vq94CVE-2010-3714Affected >=4.2.0 <4.2.15, >=4.3.0 <4.3.7, >=4.4.0 <4.4.4Fixed in 4.2.15 Fixed in 4.3.7 Fixed in 4.4.4OSV source ↗4 years ago

HighTYPO3 vulnerable to remote authenticated arbitrary code executionGHSA-m76j-69c2-c3m8CVE-2013-4321Affected >=6.0.0 <6.0.9, >=6.1.0 <6.1.4Fixed in 6.0.9 Fixed in 6.1.4OSV source ↗4 years ago

HighTYPO3 doesn't properly check file extensionsGHSA-54jj-pxx2-pv8hCVE-2013-4250Affected >=6.0.0 <6.0.8, >=6.1.0 <6.1.3Fixed in 6.0.8 Fixed in 6.1.3OSV source ↗4 years ago

HighTypo3 Vulnerable to Cache PoisoningGHSA-5479-gqqr-f9gjCVE-2014-9509Affected >=4.5.0 <4.5.39, >=4.6.0 <4.6.19, >=4.7.0 <4.7.21, >=6.0.0 <6.0.15, >=6.1.0 <6.1.13, >=6.2.0 <6.2.9, >=7.0.0 <7.0.2Fixed in 4.5.39 Fixed in 4.6.19 Fixed in 4.7.21 Fixed in 6.0.15 Fixed in 6.1.13 Fixed in 6.2.9 Fixed in 7.0.2OSV source ↗4 years ago

HighPHP OpenID Library Denial of Service vulnerabilityGHSA-5qp6-78pr-gv8cCVE-2013-4701Affected >=6.2.0 <6.2.6Fixed in 6.2.6OSV source ↗4 years ago

HighTYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP codeGHSA-55g3-fjwm-w2c8CVE-2014-3942Affected >=4.5.0 <4.5.34, >=4.7.0 <4.7.19, >=6.0.0 <6.0.14, >=6.1.0 <6.1.9Fixed in 4.5.34 Fixed in 4.7.19 Fixed in 6.0.14 Fixed in 6.1.9OSV source ↗4 years ago

HighTYPO3 PHP remote file inclusion vulnerabilityGHSA-4h9j-f98m-p4hgCVE-2010-1153Affected >=4.3.0 <4.3.3Fixed in 4.3.3OSV source ↗5 years ago

HighIndexed Search Engine for TYPO3 Command Execution via Metacharacter InjectionGHSA-74w6-ww7w-45j9CVE-2009-0258Affected >=4.0.0 <4.0.10, >=4.1.0 <4.1.8, >=4.2.0 <4.2.4Fixed in 4.0.10 Fixed in 4.1.8 Fixed in 4.2.4OSV source ↗5 years ago

HighAuthentication library in TYPO3 vulnerable to session fixationGHSA-q45q-5233-229pCVE-2009-0256Affected >=4.0.0 <4.0.10, >=4.1.0 <4.1.8, >=4.2.0 <4.2.4Fixed in 4.0.10 Fixed in 4.1.8 Fixed in 4.2.4OSV source ↗5 years ago

HighTYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`GHSA-xj84-6q8f-qg2rCVE-2005-4875Affected <3.8.1Fixed in 3.8.1OSV source ↗5 years ago

HighBackend Same-Site Request Forgery in TYPO3 CMSGHSA-pqg8-crx9-g8m4BIT-typo3-2020-11069CVE-2020-11069Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighTYPO3 Denial of Service in Frontend Record RegistrationGHSA-g585-crjf-vhwqAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21Fixed in 7.6.32 Fixed in 8.7.21OSV source ↗2 years ago

HighTYPO3 Image Processing susceptible to Code ExecutionGHSA-3w4h-r27h-4r2wCVE-2019-11832Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗4 years ago

HighTYPO3 Security Misconfiguration for Backend User AccountsGHSA-c5mj-39cf-3pp5Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

HighTYPO3 frontend login vulnerable to Session FixationGHSA-r9vc-jfmh-6j48Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

HighDeserialization of untrusted data in SymfonyGHSA-w2fr-65vp-mxw3CVE-2019-10912Affected >=9.0.0 <9.5.8Fixed in 9.5.8OSV source ↗7 years ago

MediumTYPO3 Directory Traversal on ZIP extractionGHSA-77p4-wfr8-977wCVE-2019-19848Affected >=10.0.0 <10.2.2, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.2 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

MediumTYPO3 Denial of Service in Online Media Asset HandlingGHSA-f3wf-q4fj-3gxfAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Broken Access Control in Localization HandlingGHSA-772m-43f3-hmf8Affected >=8.0.0 <8.7.23Fixed in 8.7.23OSV source ↗2 years ago

MediumCross-Site Scripting in TYPO3 CMSGHSA-5gr6-97fv-52ccAffected >=7.6.0 <7.6.16, >=8.0.0 <8.6.1Fixed in 7.6.16 Fixed in 8.6.1OSV source ↗2 years ago

MediumPrivilege Escalation in TYPO3 CMSGHSA-v5jp-4h2p-j2p4Affected >=6.2.0 <6.2.20, >=7.6.0 <7.6.5, >=8.0.0 <8.0.1Fixed in 6.2.20 Fixed in 7.6.5 Fixed in 8.0.1OSV source ↗2 years ago

MediumTYPO3 Brute Force Protection Bypass in backend loginGHSA-jqr8-q455-xx45Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

MediumTYPO3 Information Disclosure Vulnerability Exploitable by EditorsGHSA-r287-hc8j-w56hAffected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

MediumTYPO3 vulnerable to Information Disclosure via Content Editing Wizards componentGHSA-4rpv-g4gq-rh4mCVE-2013-7073Affected >=4.5.0 <4.5.32, >=4.7.0 <4.7.17, >=6.0.0 <6.0.12, >=6.1.0 <6.1.7Fixed in 4.5.32 Fixed in 4.7.17 Fixed in 6.0.12 Fixed in 6.1.7OSV source ↗4 years ago

MediumTypo3 Arbitrary Information DisclosureGHSA-8grp-3j5v-543gCVE-2011-4901Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Arbitrary File DeleteGHSA-9vxq-mxw5-mcgpCVE-2011-4902Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Improper Access ControlGHSA-qf79-34j4-54m6CVE-2011-4904Affected <4.4.9, >=4.5.0 <4.5.4Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Information DisclosureGHSA-rwx5-7x5r-jgrmCVE-2011-4900Affected <4.5.4Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Information DisclosureGHSA-frf4-5p2c-c3ffCVE-2011-4627Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

MediumInsecure Unserialize in TYPO3 Import/ExportGHSA-xvcp-33rc-j8gqAffected >=6.2.0 <6.2.26, >=7.6.0 <7.6.10, >=8.0.0 <8.2.1Fixed in 6.2.26 Fixed in 7.6.10 Fixed in 8.2.1OSV source ↗2 years ago

MediumTYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards componentGHSA-47ww-mq32-g4xwCVE-2013-7075Affected >=4.5.0 <4.5.32, >=4.7.0 <4.7.17, >=6.0.0 <6.0.12, >=6.1.0 <6.1.7Fixed in 4.5.32 Fixed in 4.7.17 Fixed in 6.0.12 Fixed in 6.1.7OSV source ↗4 years ago

MediumTYPO3 Cross-Site Scripting in Form Framework validation handlingGHSA-v8m4-3w37-ghxxAffected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Form FrameworkGHSA-4h5c-5g25-v7fhAffected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Link HandlingGHSA-xgmx-j3hv-jh9xAffected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Filelist ModuleGHSA-g7hw-jh4p-75wrAffected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Fluid ViewHelpersGHSA-85ch-44w7-rf32Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site ScriptingGHSA-mxjf-hc9v-xgv2Affected >=4.5.0 <4.5.34, >=4.7.0 <4.7.19, >=6.1.0 <6.1.9, >=6.2.0 <6.2.3Fixed in 4.5.34 Fixed in 4.7.19 Fixed in 6.1.9 Fixed in 6.2.3OSV source ↗2 years ago

MediumTypo3 Cross-Site Scripting in Link HandlingGHSA-r6fv-56gp-j3r4CVE-2019-12748Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗4 years ago

MediumTypo3 Cross-Site Scripting in Flash component (ELTS)GHSA-qvhv-pwww-53jjBIT-typo3-2020-8091CVE-2020-8091Affected >=6.2.0 <6.2.39, >=7.0.0 <7.2.0Fixed in 6.2.39 Fixed in 7.2.0OSV source ↗4 years ago

MediumTYPO3 allows remote attackers to embed Flash videos from external domainGHSA-3f58-74qw-ph75CVE-2015-8760Affected >=6.2.0 <6.2.16Fixed in 6.2.16OSV source ↗4 years ago