Search for packages
| purl | pkg:composer/typo3/cms-core@8.5.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-9jj4-ec9n-qbhs
Aliases: 2018-07-12-4 |
Insecure Deserialization in TYPO3 CMS. |
Affected by 76 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 102 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ayw6-8pn4-17eb
Aliases: GHSA-96jg-pmc4-cx39 |
TYPO3 CMS Insecure Deserialization It has been discovered that the Form Framework (system extension `form`) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package `yaml`, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting `yaml.decode_php` enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation). |
Affected by 76 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 105 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-mh4f-vtfj-hbb1
Aliases: GHSA-4459-qrcc-vfcf |
TYPO3 Cross-Site Scripting in Form Framework Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting. |
Affected by 46 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 75 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wkm6-cgc8-bfa8
Aliases: 2018-07-12-3 |
Privilege Escalation & SQL Injection in TYPO3 CMS. |
Affected by 76 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 102 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zw9b-6vkf-3fc6
Aliases: GHSA-45wj-jv2h-jwrf |
TYPO3 CMS Privilege Escalation and SQL Injection Failing to properly dissociate system related configuration from user generated configuration, the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation. Basically instructions can be persisted to a form definition file that were not configured to be modified - this applies to definitions managed using the form editor module as well as direct file upload using the regular file list module. A valid backend user account as well as having system extension form activated are needed in order to exploit this vulnerability. |
Affected by 76 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 102 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||