.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms 6.2.0 vulnerabilities

188 advisories known · typo3/cms@6.2.0 · 53 affect this release · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Affects 6.2.0

SEVERITYADVISORYPUBLISHED

CriticalMissing Access Check in TYPO3 CMSGHSA-gwfx-p7mr-f92vAffected >=6.2.0 <6.2.25, >=7.6.0 <7.6.8, >=8.0.0 <8.1.1Fixed in 6.2.25 Fixed in 7.6.8 Fixed in 8.1.1OSV source ↗2 years ago

HighTYPO3 may allow editors to change, create, or delete metadata of files not within their file mountsGHSA-4r76-xr68-w7m7Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

HighTYPO3 Arbitrary Shell Execution in Swiftmailer libraryGHSA-45xg-4w5x-j429Affected >=4.5.0 <4.5.37, >=4.7.0 <4.7.20, >=6.1.0 <6.1.12, >=6.2.0 <6.2.6Fixed in 4.5.37 Fixed in 4.7.20 Fixed in 6.1.12 Fixed in 6.2.6OSV source ↗2 years ago

HighTYPO3 Remote Code Execution in third party library swiftmailerGHSA-g4pf-3jvq-2gcwAffected >=6.2.0 <6.2.30, >=7.6.0 <7.6.15, >=8.0.0 <8.5.1Fixed in 6.2.30 Fixed in 7.6.15 Fixed in 8.5.1OSV source ↗2 years ago

HighXML External Entity (XXE) Processing in TYPO3 CoreGHSA-qffc-gwpp-m2xrAffected >=6.2.0 <6.2.19, >=7.6.0 <7.6.4Fixed in 6.2.19 Fixed in 7.6.4OSV source ↗2 years ago

HighTYPO3 SQL Injection in dbalGHSA-9895-53fc-98v2Affected >=6.2.0 <6.2.18Fixed in 6.2.18OSV source ↗2 years ago

HighTYPO3 possible cache poisoning on the homepage when anchors are usedGHSA-p84g-j2gh-83g3Affected >=6.2.0 <6.2.9, >=7.0.0 <7.0.2Fixed in 6.2.9 Fixed in 7.0.2OSV source ↗2 years ago

HighTypo3 Vulnerable to Cache PoisoningGHSA-5479-gqqr-f9gjCVE-2014-9509Affected >=4.5.0 <4.5.39, >=4.6.0 <4.6.19, >=4.7.0 <4.7.21, >=6.0.0 <6.0.15, >=6.1.0 <6.1.13, >=6.2.0 <6.2.9, >=7.0.0 <7.0.2Fixed in 4.5.39 Fixed in 4.6.19 Fixed in 4.7.21 Fixed in 6.0.15 Fixed in 6.1.13 Fixed in 6.2.9 Fixed in 7.0.2OSV source ↗4 years ago

HighPHP OpenID Library Denial of Service vulnerabilityGHSA-5qp6-78pr-gv8cCVE-2013-4701Affected >=6.2.0 <6.2.6Fixed in 6.2.6OSV source ↗4 years ago

HighTYPO3 frontend login vulnerable to Session FixationGHSA-r9vc-jfmh-6j48Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

MediumPrivilege Escalation in TYPO3 CMSGHSA-v5jp-4h2p-j2p4Affected >=6.2.0 <6.2.20, >=7.6.0 <7.6.5, >=8.0.0 <8.0.1Fixed in 6.2.20 Fixed in 7.6.5 Fixed in 8.0.1OSV source ↗2 years ago

MediumTYPO3 Brute Force Protection Bypass in backend loginGHSA-jqr8-q455-xx45Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

MediumTYPO3 Information Disclosure Vulnerability Exploitable by EditorsGHSA-r287-hc8j-w56hAffected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

MediumInsecure Unserialize in TYPO3 Import/ExportGHSA-xvcp-33rc-j8gqAffected >=6.2.0 <6.2.26, >=7.6.0 <7.6.10, >=8.0.0 <8.2.1Fixed in 6.2.26 Fixed in 7.6.10 Fixed in 8.2.1OSV source ↗2 years ago

MediumExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site ScriptingGHSA-mxjf-hc9v-xgv2Affected >=4.5.0 <4.5.34, >=4.7.0 <4.7.19, >=6.1.0 <6.1.9, >=6.2.0 <6.2.3Fixed in 4.5.34 Fixed in 4.7.19 Fixed in 6.1.9 Fixed in 6.2.3OSV source ↗2 years ago

MediumTypo3 Cross-Site Scripting in Flash component (ELTS)GHSA-qvhv-pwww-53jjBIT-typo3-2020-8091CVE-2020-8091Affected >=6.2.0 <6.2.39, >=7.0.0 <7.2.0Fixed in 6.2.39 Fixed in 7.2.0OSV source ↗4 years ago

MediumTYPO3 allows remote attackers to embed Flash videos from external domainGHSA-3f58-74qw-ph75CVE-2015-8760Affected >=6.2.0 <6.2.16Fixed in 6.2.16OSV source ↗4 years ago

MediumTYPO3 Backend component Cross-site scripting (XSS) vulnerabilityGHSA-ffcm-vhcw-p32rCVE-2016-4056Affected >=6.2.0 <6.2.19Fixed in 6.2.19OSV source ↗4 years ago

MediumCross-Site Scripting (XSS) vulnerability in typolinksGHSA-p5c5-gmj4-g48fAffected >=6.2.0 <6.2.26, >=7.6.0 <7.6.10, >=8.0.0 <8.2.1Fixed in 6.2.26 Fixed in 7.6.10 Fixed in 8.2.1OSV source ↗2 years ago

MediumCross-Site Scripting (XSS) in TYPO3 BackendGHSA-hq37-rfjc-mr8hAffected >=6.2.0 <6.2.27, >=7.6.0 <7.6.11, >=8.0.0 <8.3.1Fixed in 6.2.27 Fixed in 7.6.11 Fixed in 8.3.1OSV source ↗2 years ago

MediumDenial of Service (DoS) attack possibility in TYPO3 component Indexed SearchGHSA-pmxp-7224-h794Affected >=6.2.0 <6.2.19, >=7.6.0 <7.6.4Fixed in 6.2.19 Fixed in 7.6.4OSV source ↗2 years ago

MediumTypo3 Arbitrary File Disclosure in Form ComponentGHSA-wrpf-2x8h-82grAffected >=6.2.0 <6.2.20Fixed in 6.2.20OSV source ↗2 years ago

MediumCross-Site Scripting (XSS) in TYPO3 component CSS styled contentGHSA-8j9v-4hhh-x43cAffected >=6.2.0 <6.2.19, >=7.6.0 <7.6.4Fixed in 6.2.19 Fixed in 7.6.4OSV source ↗2 years ago

MediumCross-Site Scripting (XSS) in TYPO3 component BackendGHSA-3jxq-5xhh-9jr3Affected >=6.2.0 <6.2.19Fixed in 6.2.19OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting (XSS) in form componentGHSA-5j86-5xvg-7q93Affected >=6.2.0 <6.2.18Fixed in 6.2.18OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in legacy form componentGHSA-vgm8-r9gm-fw59Affected >=6.2.0 <6.2.18Fixed in 6.2.18OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in link validator componentGHSA-cg4m-qjjp-7497Affected >=6.2.0 <6.2.18, >=7.6.0 <7.6.3Fixed in 6.2.18 Fixed in 7.6.3OSV source ↗2 years ago

MediumTYPO3 Multiple Cross-Site Scripting vulnerabilities in frontendGHSA-6fc6-cj2j-h22xAffected >=6.2.0 <6.2.16, >=7.0.0 <7.6.1Fixed in 6.2.16 Fixed in 7.6.1OSV source ↗2 years ago

MediumCross-Site Scripting in TYPO3 component Indexed SearchGHSA-wh8q-72cp-p5wfAffected >=6.2.0 <6.2.16Fixed in 6.2.16OSV source ↗2 years ago

MediumTYPO3 is susceptible to Cross-Site FlashingGHSA-qrxh-46mr-pr7qAffected >=6.2.0 <6.2.16Fixed in 6.2.16OSV source ↗2 years ago

MediumMultiple Cross-Site Scripting vulnerabilities in TYPO3 backendGHSA-5cxf-xx9j-54jcAffected >=6.2.0 <6.2.16, >=7.0.0 <7.6.1Fixed in 6.2.16 Fixed in 7.6.1OSV source ↗2 years ago

MediumPath Traversal in TYPO3 CoreGHSA-gj48-w74w-8gvmAffected >=6.2.0 <6.2.29, >=7.6.0 <7.6.13, >=8.0.0 <8.4.1Fixed in 6.2.29 Fixed in 7.6.13 Fixed in 8.4.1OSV source ↗3 years ago

MediumTYPO3 Improper Session InvalidationGHSA-9j8h-xrgj-7gw2CVE-2014-3944Affected >=6.2.0 <6.2.3Fixed in 6.2.3OSV source ↗4 years ago

MediumTypo3 Information DisclosureGHSA-vccp-5v5h-p8m6CVE-2014-3946Affected >=6.2.0 <6.2.3Fixed in 6.2.3OSV source ↗4 years ago

MediumTypo3 Open Redirect In Frontend RenderingGHSA-v6xv-rmqc-wcc8CVE-2014-9508Affected >=4.5.0 <4.5.39, >=4.6.0 <6.2.9, >=7.0.0 <7.0.2Fixed in 4.5.39 Fixed in 6.2.9 Fixed in 7.0.2OSV source ↗4 years ago

MediumTypo3 Host Header Spoofing VulnerabilityGHSA-594h-cx6w-p4jfCVE-2014-3941Affected >=4.5.0 <4.5.34, >=4.7.0 <4.7.19, >=6.0.0 <6.0.14, >=6.1.0 <6.1.9, >=6.2.0 <6.2.3Fixed in 4.5.34 Fixed in 4.7.19 Fixed in 6.0.14 Fixed in 6.1.9 Fixed in 6.2.3OSV source ↗4 years ago

MediumMoodle cross-site scripting (XSS) vulnerabilitiesGHSA-j6c3-3c4w-qv8pCVE-2013-7341Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗4 years ago

MediumTypo3 Backend XSS VulnerabilityGHSA-jg55-3q6h-2ccfCVE-2009-0816Affected >=3.3.0Fixed in 4.0.12 Fixed in 4.1.10 Fixed in 4.2.6OSV source ↗5 years ago

MediumSQL Injection in TYPO3 Frontend LoginGHSA-j86x-pjmr-9m6wAffected >=6.2.0 <6.2.26, >=7.6.0 <7.6.10Fixed in 6.2.26 Fixed in 7.6.10OSV source ↗2 years ago

MediumAuthentication Bypass in TYPO3 CMSGHSA-6xh8-8pfv-53vxAffected >=6.2.0 <6.2.20, >=7.6.0 <7.6.5, >=8.0.0 <8.0.1Fixed in 6.2.20 Fixed in 7.6.5 Fixed in 8.0.1OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting Vulnerability Exploitable by EditorsGHSA-wp8j-c736-c5r3Affected >=6.2.0 <6.2.14, >=7.0.0 <7.3.1Fixed in 6.2.14 Fixed in 7.3.1OSV source ↗2 years ago

MediumTYPO3 Cross-site Scripting vulnerabilityGHSA-j5v7-9xr5-m7gxCVE-2015-8759Affected >=6.2.0 <6.2.16, >=7.0.0 <7.6.1Fixed in 6.2.16 Fixed in 7.6.1OSV source ↗4 years ago

MediumTYPO3 CMS indexed search Cross-site Scripting vulnerabilityGHSA-xx7m-8rq2-cw2vCVE-2015-8756Affected >=6.2.0 <6.2.16Fixed in 6.2.16OSV source ↗4 years ago

MediumTypo3 XSS VulnerabilityGHSA-56f9-5563-m2h7CVE-2015-8755Affected >=6.2 <6.2.16, >=7.0 <7.6.1Fixed in 6.2.16 Fixed in 7.6.1OSV source ↗4 years ago

MediumCache Flooding in TYPO3 FrontendGHSA-pw2q-qwvj-gh43Affected >=6.2.0 <6.2.27, >=7.6.0 <7.6.11, >=8.0.0 <8.3.1Fixed in 6.2.27 Fixed in 7.6.11 Fixed in 8.3.1OSV source ↗2 years ago

MediumInformation Disclosure in TYPO3 BackendGHSA-vpr3-rc99-2wprAffected >=6.2.0 <6.2.26, >=7.6.0 <7.6.10, >=8.0.0 <8.2.1Fixed in 6.2.26 Fixed in 7.6.10 Fixed in 8.2.1OSV source ↗2 years ago

MediumTYPO3 Frontend vulnerable to Unauthenticated Path DisclosureGHSA-pqfv-97hj-g97gAffected >=6.2.0 <6.2.15, >=7.0.0 <7.4.0Fixed in 6.2.15 Fixed in 7.4.0OSV source ↗2 years ago

MediumInsecure Unserialize in TYPO3 BackendGHSA-c7rj-92xr-wprgAffected >=6.2.0 <6.2.29, >=7.6.0 <7.6.13, >=8.0.0 <8.4.1Fixed in 6.2.29 Fixed in 7.6.13 Fixed in 8.4.1OSV source ↗2 years ago

MediumTypo3 XSS VulnerabilityGHSA-3w22-wrwx-2r75CVE-2018-6905Affected <9.2.0Fixed in 9.2.0OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3 BackendGHSA-86r8-4g3w-7xjpAffected >=6.2.0 <6.2.26, >=7.6.0 <7.6.10, >=8.0.0 <8.2.1Fixed in 6.2.26 Fixed in 7.6.10 Fixed in 8.2.1OSV source ↗2 years ago

MediumCross-Site Scripting in TYPO3 BackendGHSA-5wx6-xwxf-q8qjAffected >=6.2.0 <6.2.20, >=7.6.0 <7.6.5, >=8.0.0 <8.0.1Fixed in 6.2.20 Fixed in 7.6.5 Fixed in 8.0.1OSV source ↗2 years ago

LowTypo3 XSS VulnerabilitiesGHSA-qqh2-h6gw-6x8xCVE-2014-3943Affected >=4.5.0 <4.5.34, >=4.7.0 <4.7.19, >=6.0.0 <6.0.14, >=6.1.0 <6.1.9, >=6.2.0 <6.2.3Fixed in 4.5.34 Fixed in 4.7.19 Fixed in 6.0.14 Fixed in 6.1.9 Fixed in 6.2.3OSV source ↗4 years ago

LowTYPO3 cross-site scripting (XSS)GHSA-989h-wv8x-933pCVE-2015-5956Affected >=4.0 <=4.5.40, >=6.0 <6.2.15, >=7.0 <7.4.0Fixed in 6.2.15 Fixed in 7.4.0OSV source ↗4 years ago

Does not affect 6.2.0

SEVERITYADVISORYPUBLISHED

CriticalArbitrary Code Execution in TYPO3 CMSGHSA-67wg-6j7r-mqh8Affected >=7.6.0 <7.6.22, >=8.0.0 <8.7.5Fixed in 7.6.22 Fixed in 8.7.5OSV source ↗2 years ago

CriticalTYPO3 vulnerable to Insufficient Session ExpirationGHSA-53mm-hx32-6475CVE-2022-47406Affected <2.0.5, >=3.0.0 <3.0.3Fixed in 2.0.5 Fixed in 3.0.3OSV source ↗4 years ago

CriticalTypo3 SQL injection due to faulty prepared statementsGHSA-gx4p-6w86-f8jxCVE-2011-3583Affected >=4.5.0 <=4.5.5OSV source ↗5 years ago

CriticalTypo3 Authentication BypassGHSA-79gv-5cgx-x6rxCVE-2011-4628Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

CriticalTYPO3 vulnerable to authentication bypass via leveraging knowledge of password hashGHSA-h7wf-jg4f-x2wcCVE-2014-3945Affected <6.2.0Fixed in 6.2.0OSV source ↗4 years ago

HighTYPO3 Arbitrary Code Execution via File List ModuleGHSA-8h4m-r4wm-xj7rAffected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

HighPrivilege Escalation & SQL Injection in TYPO3 CMSGHSA-7qwg-fcpw-xg5gAffected >=8.5.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighTYPO3 is vulnerable to Cross-Site Scripting via frontend renderingGHSA-r4f8-f93x-5qh3BIT-typo3-2023-24814CVE-2023-24814Affected >=10.0.0 <10.4.35, >=11.0.0 <11.5.23, >=12.0.0 <12.2.0Fixed in 10.4.35 Fixed in 11.5.23 Fixed in 12.2.0OSV source ↗4 years ago

HighTYPO3 Vulnerable to Insecure DeserializationGHSA-86hp-xrhj-fhpqCVE-2019-12747Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗4 years ago

HighTYPO3 Insecure Deserialization in Query Generator & Query ViewGHSA-rcgc-4xfc-564vCVE-2019-19849Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

HighTYPO3 Arbitrary Code ExecutionGHSA-fh4q-hxrw-cjqqCVE-2017-14251Affected >=7.6.0 <7.6.22, >=8.0.0 <8.7.5Fixed in 7.6.22 Fixed in 8.7.5OSV source ↗4 years ago

HighCross-Site-Request-Forgery in BackendGHSA-657m-v5vm-f6rwBIT-typo3-2021-41113CVE-2021-41113Affected >=11.2.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

HighMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSGHSA-m5vr-3m74-jwxpBIT-typo3-2020-15098CVE-2020-15098Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6 Fixed in 9.5.20OSV source ↗6 years ago

HighInsecure Deserialization in Backend User Settings in TYPO3 CMSGHSA-2wj9-434x-9hvpBIT-typo3-2020-11067CVE-2020-11067Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighClass destructors causing side-effects when being unserialized in TYPO3 CMSGHSA-2rxh-h6h9-qrqcBIT-typo3-2020-11066CVE-2020-11066Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighUnrestricted File Upload in Form FrameworkGHSA-2r6j-862c-m2v2BIT-typo3-2021-21355CVE-2021-21355Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

HighBroken Access Control in Form FrameworkGHSA-3vg7-jw9m-pc3fBIT-typo3-2021-21357CVE-2021-21357Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

HighTYPO3 Security Misconfiguration in Install Tool CookieGHSA-f777-f784-36gmAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

HighTYPO3 CMS Possible Insecure Deserialization in Extbase Request HandlingGHSA-hh95-5xm5-v8v7Affected >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

HighCleartext storage of session identifierGHSA-954j-f27r-cj52BIT-typo3-2020-26228CVE-2020-26228Affected >=10.0.0 <10.4.10, >=8.7.0 <8.7.38, >=9.0.0 <9.5.23Fixed in 10.4.10 Fixed in 8.7.38 Fixed in 9.5.23OSV source ↗6 years ago

HighExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSGHSA-3x94-fv5h-5q2cBIT-typo3-2020-15099CVE-2020-15099Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6 Fixed in 9.5.20OSV source ↗6 years ago

HighInsecure Deserialization & Arbitrary Code Execution in TYPO3 CMSGHSA-ppgf-8745-8pgxAffected >=7.0.0 <7.6.30, >=8.0.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 7.6.30 Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighInsecure Deserialization in TYPO3 CMSGHSA-8h28-f46f-m87hAffected >=8.5.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighTYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanismGHSA-w736-qv86-vq94CVE-2010-3714Affected >=4.2.0 <4.2.15, >=4.3.0 <4.3.7, >=4.4.0 <4.4.4Fixed in 4.2.15 Fixed in 4.3.7 Fixed in 4.4.4OSV source ↗4 years ago

HighTYPO3 vulnerable to remote authenticated arbitrary code executionGHSA-m76j-69c2-c3m8CVE-2013-4321Affected >=6.0.0 <6.0.9, >=6.1.0 <6.1.4Fixed in 6.0.9 Fixed in 6.1.4OSV source ↗4 years ago

HighTYPO3 doesn't properly check file extensionsGHSA-54jj-pxx2-pv8hCVE-2013-4250Affected >=6.0.0 <6.0.8, >=6.1.0 <6.1.3Fixed in 6.0.8 Fixed in 6.1.3OSV source ↗4 years ago

HighTYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP codeGHSA-55g3-fjwm-w2c8CVE-2014-3942Affected >=4.5.0 <4.5.34, >=4.7.0 <4.7.19, >=6.0.0 <6.0.14, >=6.1.0 <6.1.9Fixed in 4.5.34 Fixed in 4.7.19 Fixed in 6.0.14 Fixed in 6.1.9OSV source ↗4 years ago

HighTYPO3 PHP remote file inclusion vulnerabilityGHSA-4h9j-f98m-p4hgCVE-2010-1153Affected >=4.3.0 <4.3.3Fixed in 4.3.3OSV source ↗5 years ago

HighIndexed Search Engine for TYPO3 Command Execution via Metacharacter InjectionGHSA-74w6-ww7w-45j9CVE-2009-0258Affected >=4.0.0 <4.0.10, >=4.1.0 <4.1.8, >=4.2.0 <4.2.4Fixed in 4.0.10 Fixed in 4.1.8 Fixed in 4.2.4OSV source ↗5 years ago

HighAuthentication library in TYPO3 vulnerable to session fixationGHSA-q45q-5233-229pCVE-2009-0256Affected >=4.0.0 <4.0.10, >=4.1.0 <4.1.8, >=4.2.0 <4.2.4Fixed in 4.0.10 Fixed in 4.1.8 Fixed in 4.2.4OSV source ↗5 years ago

HighTYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`GHSA-xj84-6q8f-qg2rCVE-2005-4875Affected <3.8.1Fixed in 3.8.1OSV source ↗5 years ago

HighBackend Same-Site Request Forgery in TYPO3 CMSGHSA-pqg8-crx9-g8m4BIT-typo3-2020-11069CVE-2020-11069Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighTYPO3 Denial of Service in Frontend Record RegistrationGHSA-g585-crjf-vhwqAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21Fixed in 7.6.32 Fixed in 8.7.21OSV source ↗2 years ago

HighTYPO3 CMS vulnerable to Arbitrary Code Execution via Form FrameworkGHSA-c5wx-6c2c-f7rmBIT-typo3-2022-23503CVE-2022-23503Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1OSV source ↗4 years ago

HighTYPO3 Image Processing susceptible to Code ExecutionGHSA-3w4h-r27h-4r2wCVE-2019-11832Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗4 years ago

HighTYPO3 Security Misconfiguration for Backend User AccountsGHSA-c5mj-39cf-3pp5Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

HighDeserialization of untrusted data in SymfonyGHSA-w2fr-65vp-mxw3CVE-2019-10912Affected >=9.0.0 <9.5.8Fixed in 9.5.8OSV source ↗7 years ago

MediumTYPO3 Directory Traversal on ZIP extractionGHSA-77p4-wfr8-977wCVE-2019-19848Affected >=10.0.0 <10.2.2, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.2 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

MediumTYPO3 Denial of Service in Online Media Asset HandlingGHSA-f3wf-q4fj-3gxfAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Broken Access Control in Localization HandlingGHSA-772m-43f3-hmf8Affected >=8.0.0 <8.7.23Fixed in 8.7.23OSV source ↗2 years ago

MediumCross-Site Scripting in TYPO3 CMSGHSA-5gr6-97fv-52ccAffected >=7.6.0 <7.6.16, >=8.0.0 <8.6.1Fixed in 7.6.16 Fixed in 8.6.1OSV source ↗2 years ago

MediumTYPO3 vulnerable to Information Disclosure via Content Editing Wizards componentGHSA-4rpv-g4gq-rh4mCVE-2013-7073Affected >=4.5.0 <4.5.32, >=4.7.0 <4.7.17, >=6.0.0 <6.0.12, >=6.1.0 <6.1.7Fixed in 4.5.32 Fixed in 4.7.17 Fixed in 6.0.12 Fixed in 6.1.7OSV source ↗4 years ago

MediumTypo3 Arbitrary Information DisclosureGHSA-8grp-3j5v-543gCVE-2011-4901Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Arbitrary File DeleteGHSA-9vxq-mxw5-mcgpCVE-2011-4902Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Improper Access ControlGHSA-qf79-34j4-54m6CVE-2011-4904Affected <4.4.9, >=4.5.0 <4.5.4Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Information DisclosureGHSA-rwx5-7x5r-jgrmCVE-2011-4900Affected <4.5.4Fixed in 4.5.4OSV source ↗5 years ago

MediumTypo3 Information DisclosureGHSA-frf4-5p2c-c3ffCVE-2011-4627Affected <4.3.12, >=4.4.0 <4.4.9, >=4.5.0 <4.5.4Fixed in 4.3.12 Fixed in 4.4.9 Fixed in 4.5.4OSV source ↗5 years ago