{"url":"http://public2.vulnerablecode.io/api/packages/387823?format=json","purl":"pkg:composer/typo3/flow@2.0.0","type":"composer","namespace":"typo3","name":"flow","version":"2.0.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"2.3.16","latest_non_vulnerable_version":"4.0.6","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/270090?format=json","vulnerability_id":"VCID-9rxm-t1av-zfaw","summary":"","references":[{"reference_url":"http://osvdb.org/100825","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://osvdb.org/100825"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-7082","reference_id":"","reference_type":"","scores":[{"value":"0.00309","scoring_system":"epss","scoring_elements":"0.54505","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-7082"},{"reference_url":"http://secunia.com/advisories/55996","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://secunia.com/advisories/55996"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89614","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89614"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/neos/flow/CVE-2013-7082.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/neos/flow/CVE-2013-7082.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/flow/CVE-2013-7082.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/flow/CVE-2013-7082.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7082","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7082"},{"reference_url":"https://www.neos.io/blog/flow-sa-2013-001.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.neos.io/blog/flow-sa-2013-001.html"},{"reference_url":"https://www.neos.io/news/flow-sa-2013-001.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.neos.io/news/flow-sa-2013-001.html"},{"reference_url":"http://typo3.org/teams/security/security-bulletins/typo3-flow/typo3-flow-sa-2013-001","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://typo3.org/teams/security/security-bulletins/typo3-flow/typo3-flow-sa-2013-001"},{"reference_url":"https://github.com/advisories/GHSA-vc74-c4m6-9979","reference_id":"GHSA-vc74-c4m6-9979","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-vc74-c4m6-9979"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/385232?format=json","purl":"pkg:composer/typo3/flow@2.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-q21c-2rcq-wkgt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@2.0.1"}],"aliases":["CVE-2013-7082","GHSA-vc74-c4m6-9979"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9rxm-t1av-zfaw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/361833?format=json","vulnerability_id":"VCID-q21c-2rcq-wkgt","summary":"Time-Based Information Disclosure Vulnerability\nThe `PersistedUsernamePasswordProvider` is prone to a information disclosure of account existence based on timing attacks as the hashing of passwords is only done in case an account is found.","references":[{"reference_url":"https://www.neos.io/blog/flow-sa-2016-001.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.neos.io/blog/flow-sa-2016-001.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/31987?format=json","purl":"pkg:composer/typo3/flow@2.3.16","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@2.3.16"},{"url":"http://public2.vulnerablecode.io/api/packages/31990?format=json","purl":"pkg:composer/typo3/flow@3.0.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-rstt-ts79-cyce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@3.0.10"},{"url":"http://public2.vulnerablecode.io/api/packages/31988?format=json","purl":"pkg:composer/typo3/flow@3.1.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-rstt-ts79-cyce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@3.1.7"},{"url":"http://public2.vulnerablecode.io/api/packages/31991?format=json","purl":"pkg:composer/typo3/flow@3.2.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-rstt-ts79-cyce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@3.2.7"},{"url":"http://public2.vulnerablecode.io/api/packages/31989?format=json","purl":"pkg:composer/typo3/flow@3.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-rstt-ts79-cyce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@3.3.5"}],"aliases":["Flow-SA-2016-001"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q21c-2rcq-wkgt"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/361432?format=json","vulnerability_id":"VCID-ykrs-cmfk-2qff","summary":"Insecure Deserialization\nInsecure Unserialize Vulnerability in FLOW3.","references":[{"reference_url":"https://www.neos.io/news/flow-sa-2012-001.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.neos.io/news/flow-sa-2012-001.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/387823?format=json","purl":"pkg:composer/typo3/flow@2.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9rxm-t1av-zfaw"},{"vulnerability":"VCID-q21c-2rcq-wkgt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@2.0.0"}],"aliases":["GMS-2012-17"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ykrs-cmfk-2qff"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/typo3/flow@2.0.0"}