Search for packages
Package details: pkg:composer/typo3/cms@7.2.0
purl pkg:composer/typo3/cms@7.2.0
Next non-vulnerable version 10.4.35
Latest non-vulnerable version 12.2.0
Risk
Vulnerabilities affecting this package (60)
Vulnerability Summary Fixed by
VCID-1txn-xjt1-37ha
Aliases:
2018-12-11-3
Cross-site Scripting Cross-Site Scripting in Frontend User Login.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-2k75-zp2r-67da
Aliases:
TYPO3-CORE-SA-2015-012
Cross-Site Scripting vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors can insert javascript commands by using the url scheme "javascript:".
7.6.1
Affected by 87 other vulnerabilities.
VCID-33h5-eea4-rben
Aliases:
2015-12-15-2
Cross-site Scripting Cross-Site Scripting vulnerability in typolinks.
7.6.1
Affected by 87 other vulnerabilities.
VCID-4mfu-2wkc-ybbw
Aliases:
GHSA-8m6j-p5jv-v69w
TYPO3 Cross-Site Scripting in Online Media Asset Rendering Failing to properly encode user input, online media asset rendering (`*.youtube` and `*.vimeo` files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-4zub-buj2-5kbh
Aliases:
GHSA-f3wf-q4fj-3gxf
TYPO3 Denial of Service in Online Media Asset Handling Online Media Asset Handling (*`.youtube` and *`.vimeo` files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-53bg-1gfq-7bap
Aliases:
2018-12-11-2
Cross-site Scripting Cross-Site Scripting in Backend Modal Component.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-7hxf-mt3r-6bag
Aliases:
2015-07-01-6
Cross-site Scripting Cross-Site Scripting in 3rd party library Flowplayer.
7.3.0
Affected by 53 other vulnerabilities.
VCID-7rqj-m3xh-5uam
Aliases:
2015-09-08-1
Information Exposure Frontend: Unauthenticated Path Disclosure.
7.3.0
Affected by 53 other vulnerabilities.
VCID-7yn7-f2cw-ukfj
Aliases:
2018-12-11-6
Uncontrolled Resource Consumption Denial of Service in Online Media Asset Handling.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-8mc9-ye3u-c3aj
Aliases:
CVE-2019-19849
GHSA-rcgc-4xfc-564v
TYPO3 Insecure Deserialization in Query Generator & Query View An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.1
Affected by 41 other vulnerabilities.
10.2.2
Affected by 41 other vulnerabilities.
VCID-8re4-c6j8-hyfh
Aliases:
2018-12-11-7
Uncontrolled Resource Consumption Denial of Service in Frontend Record Registration.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.0.0
Affected by 95 other vulnerabilities.
VCID-af14-5ttt-t7ac
Aliases:
TYPO3-CORE-SA-2015-011
Multiple Cross-Site Scripting vulnerabilities in backend Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.
7.6.1
Affected by 87 other vulnerabilities.
VCID-c9g4-gcfy-8ug4
Aliases:
2015-12-15-3
Cross-site Scripting Multiple Cross-Site Scripting vulnerabilities in frontend.
7.6.1
Affected by 87 other vulnerabilities.
VCID-cvpr-b5np-6bcv
Aliases:
2018-07-12-1
Improper Authentication Authentication Bypass in TYPO3 CMS.
7.6.30
Affected by 26 other vulnerabilities.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-cwsm-v895-nqc7
Aliases:
CVE-2015-5956
GHSA-989h-wv8x-933p
TYPO3 cross-site scripting (XSS) The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
7.4.0
Affected by 44 other vulnerabilities.
VCID-d42j-347n-e7en
Aliases:
CVE-2021-21338
GHSA-4jhw-2p6j-5wmp
Open Redirection in Login Handling ### Problem It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. ### Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. ### References * [TYPO3-CORE-SA-2021-001](https://typo3.org/security/advisory/typo3-core-sa-2021-001)
7.6.51
Affected by 1 other vulnerability.
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-dkr9-d6n6-puf5
Aliases:
TYPO3-CORE-SA-2015-013
Multiple Cross-Site Scripting vulnerabilities in frontend Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.
7.6.1
Affected by 87 other vulnerabilities.
VCID-dwrf-me8a-z7fa
Aliases:
2015-07-01-1
Improper Access Control Access bypass when editing file metadata.
7.3.0
Affected by 53 other vulnerabilities.
VCID-ekj9-nhu4-93cc
Aliases:
CVE-2021-21370
GHSA-x7hc-x7fm-f7qh
Cross-Site Scripting in Content Preview (CType menu) ### Problem It has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. ### Solution Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue. ### References * [TYPO3-CORE-SA-2021-008](https://typo3.org/security/advisory/typo3-core-sa-2021-008)
7.6.51
Affected by 1 other vulnerability.
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-f6sb-d831-u3fh
Aliases:
TYPO3-CORE-SA-2016-021
Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability.
7.6.11
Affected by 52 other vulnerabilities.
8.0.0
Affected by 122 other vulnerabilities.
8.3.1
Affected by 98 other vulnerabilities.
VCID-fhr8-f4h5-6ffx
Aliases:
GHSA-7q33-hxwj-7p8v
TYPO3 Cross-Site Scripting in Backend Modal Component Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-fj4s-fcy4-2fcj
Aliases:
2018-12-11-1
Cross-site Scripting Cross-Site Scripting in Online Media Asset Rendering.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-hdsj-ya24-9uhk
Aliases:
GHSA-g585-crjf-vhwq
TYPO3 Denial of Service in Frontend Record Registration TYPO3’s built-in record registration functionality (aka `basic shopping cart`) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual session-data records in the database.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
VCID-hg6g-kn76-bfbh
Aliases:
CVE-2019-19848
GHSA-77p4-wfr8-977w
TYPO3 Directory Traversal on ZIP extraction An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.2
Affected by 41 other vulnerabilities.
VCID-hrjb-bbbx-1kbq
Aliases:
2018-12-11-5
Information Disclosure in Install Tool.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-jtuy-ex79-tfbu
Aliases:
CVE-2018-6905
GHSA-3w22-wrwx-2r75
Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process.
8.7.11
Affected by 76 other vulnerabilities.
9.1.0
Affected by 92 other vulnerabilities.
9.2.0
Affected by 92 other vulnerabilities.
VCID-jyxd-d6ce-7qd9
Aliases:
GHSA-r287-hc8j-w56h
TYPO3 Information Disclosure Vulnerability Exploitable by Editors It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.
7.3.1
Affected by 47 other vulnerabilities.
VCID-k7zv-e4ez-dbaz
Aliases:
GHSA-5cxf-xx9j-54jc
Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.
7.6.1
Affected by 87 other vulnerabilities.
VCID-kh9n-kuvd-pbat
Aliases:
CVE-2022-23501
GHSA-jfp7-79g7-89rf
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login ### Problem Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. ### Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. ### References * [TYPO3-CORE-SA-2022-013](https://typo3.org/security/advisory/typo3-core-sa-2022-013)
10.4.33
Affected by 1 other vulnerability.
11.5.20
Affected by 1 other vulnerability.
12.1.1
Affected by 1 other vulnerability.
VCID-kktc-18fc-cuar
Aliases:
GHSA-pqfv-97hj-g97g
TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation.
7.4.0
Affected by 44 other vulnerabilities.
VCID-ky6n-ka2n-ayhu
Aliases:
TYPO3-CORE-SA-2016-022
Cache Flooding in Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack.
7.6.11
Affected by 52 other vulnerabilities.
8.0.0
Affected by 122 other vulnerabilities.
8.3.1
Affected by 98 other vulnerabilities.
VCID-maa6-4fkn-pqhz
Aliases:
GHSA-jqr8-q455-xx45
TYPO3 Brute Force Protection Bypass in backend login The backend login has a basic brute force protection implementation which pauses for 5 seconds if wrong credentials are given. This pause however could be bypassed by forging a special request, making brute force attacks on backend editor credentials more feasible.
7.3.1
Affected by 47 other vulnerabilities.
VCID-mf9a-exme-b3ca
Aliases:
GHSA-6f9m-v7mp-7jjq
Authentication Bypass in TYPO3 CMS It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
7.6.30
Affected by 26 other vulnerabilities.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-mgtw-94ks-a7du
Aliases:
GHSA-f777-f784-36gm
TYPO3 Security Misconfiguration in Install Tool Cookie It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-mpuk-6hdb-sqh7
Aliases:
GHSA-6487-3qvg-8px9
TYPO3 Information Disclosure in Install Tool The Install Tool exposes the current TYPO3 version number to non-authenticated users.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-n14c-7g17-qudk
Aliases:
GHSA-r9vc-jfmh-6j48
TYPO3 frontend login vulnerable to Session Fixation It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session.
7.3.1
Affected by 47 other vulnerabilities.
VCID-n7ha-dtwq-xqf9
Aliases:
2018-07-12-2
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS.
7.6.30
Affected by 26 other vulnerabilities.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-nnxd-zjsh-wqbp
Aliases:
GHSA-wp8j-c736-c5r3
TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors It has been discovered that link tags generated by typolink functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability. As second and separate vulnerability in the filelist module of the backend user interface has been referenced with this advisory as well. Error messages being shown after using a malicious name for renaming a file are not propery encoded, thus vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.
7.3.1
Affected by 47 other vulnerabilities.
VCID-q2ch-qd6x-vqeu
Aliases:
CVE-2022-31047
GHSA-fh99-4pgr-8j99
Insertion of Sensitive Information into Log File in typo3/cms-core > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that system internal credentials or keys (e.g. database credentials) have been logged as plaintext in exception handlers, when logging the complete exception stack trace. ### Solution Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. ### Credits Thanks to Marco Huber who reported this issue and to TYPO3 security member Torben Hansen who fixed the issue. ### References * [TYPO3-CORE-SA-2022-002](https://typo3.org/security/advisory/typo3-core-sa-2022-002)
10.4.29
Affected by 12 other vulnerabilities.
11.5.11
Affected by 13 other vulnerabilities.
VCID-rf5y-9xhy-ckhk
Aliases:
2015-07-01-5
Improper Restriction of Excessive Authentication Attempts Brute Force Protection Bypass in backend login.
7.3.0
Affected by 53 other vulnerabilities.
VCID-rmnv-emnu-6bfy
Aliases:
CVE-2021-32767
GHSA-34fr-fhqr-7235
Information Disclosure in User Authentication > ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration. ### Solution Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. ### Credits Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue. ### References * [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)
9.5.28
Affected by 10 other vulnerabilities.
10.4.18
Affected by 18 other vulnerabilities.
11.3.1
Affected by 20 other vulnerabilities.
VCID-rnen-s5y6-8yg1
Aliases:
CVE-2015-8759
GHSA-j5v7-9xr5-m7gx
TYPO3 Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.
7.6.1
Affected by 87 other vulnerabilities.
VCID-tvq8-qbwc-qkfs
Aliases:
CVE-2021-32768
GHSA-c5c9-8c6m-727v
Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality _[HTMLparser](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Htmlparser.html)_ do not consider all potentially malicious HTML tag & attribute combinations per default. In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. ### Solution Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above. Custom package _[typo3/html-sanitizer](https://github.com/TYPO3/html-sanitizer)_ - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios. During the frontend rendering process, sanitization is applied to the default TypoScript path `lib.parseFunc`, which is implicitly used by the Fluid view-helper instruction `f:format.html`. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding [ChangeLog documentation](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/9.5.x/Important-94484-IntroduceHTMLSanitizer.html). ### Credits Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue. ### References * [TYPO3-CORE-SA-2021-013](https://typo3.org/security/advisory/typo3-core-sa-2021-013)
7.6.53
Affected by 0 other vulnerabilities.
8.7.42
Affected by 0 other vulnerabilities.
9.5.29
Affected by 7 other vulnerabilities.
10.4.19
Affected by 17 other vulnerabilities.
11.3.2
Affected by 19 other vulnerabilities.
VCID-u4n4-rh2y-8ycg
Aliases:
GHSA-6fc6-cj2j-h22x
TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.
7.6.1
Affected by 87 other vulnerabilities.
VCID-ukvt-pj2t-9kcq
Aliases:
GHSA-2rcw-9hrm-8q7q
TYPO3 Cross-Site Scripting in Frontend User Login Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template patterns that are affected are - ###FEUSER_[fieldName]### using system extension felogin - <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-urhg-ftwf-pubr
Aliases:
2015-07-01-2
Frontend login Session Fixation.
7.3.0
Affected by 53 other vulnerabilities.
VCID-v83x-2hx7-yycg
Aliases:
CVE-2021-21339
GHSA-qx3w-4864-94ch
Cleartext storage of session identifier ### Problem User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. ### Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2021-006](https://typo3.org/security/advisory/typo3-core-sa-2021-006)
7.6.51
Affected by 1 other vulnerability.
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-w2hv-ftte-fyd1
Aliases:
CVE-2022-36107
GHSA-9c6w-55cp-5w25
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0) ### Problem It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. ### Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. ### Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2022-009](https://typo3.org/security/advisory/typo3-core-sa-2022-009) * [Vulnerability Report on huntr.dev](https://huntr.dev/bounties/51e9b709-193c-41fd-bd4a-833aaca0bd4e/) (embargoed +30 days)
10.4.32
Affected by 7 other vulnerabilities.
11.5.16
Affected by 7 other vulnerabilities.
VCID-w2qy-69nb-5ke5
Aliases:
GHSA-ppgf-8745-8pgx
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way, Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability. In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit has been identified so far.
7.6.30
Affected by 26 other vulnerabilities.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-w5s9-wjpe-bkc1
Aliases:
CVE-2013-7341
GHSA-j6c3-3c4w-qv8p
Moodle cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
7.3.1
Affected by 47 other vulnerabilities.
VCID-wvzh-uxhw-g3d5
Aliases:
2015-07-01-3
Cross-site Scripting Cross-Site Scripting exploitable by Editors.
7.3.0
Affected by 53 other vulnerabilities.
VCID-xsd3-6zyc-j7dg
Aliases:
2018-12-11-4
Security Misconfiguration in Install Tool Cookie.
7.6.32
Affected by 12 other vulnerabilities.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-xww9-ktn9-e3ga
Aliases:
CVE-2022-36105
GHSA-m392-235j-9r7r
TYPO3 CMS vulnerable to User Enumeration via Response Timing > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. ### Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. ### Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team members Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2022-007](https://typo3.org/security/advisory/typo3-core-sa-2022-007) * [Vulnerability Report on huntr.dev](https://huntr.dev/bounties/7d519735-2877-4fad-bd77-accde3e290a7/) (embargoed +30 days)
10.4.32
Affected by 7 other vulnerabilities.
11.5.16
Affected by 7 other vulnerabilities.
VCID-y8va-79qc-97cc
Aliases:
GHSA-75mx-chcf-2q32
TYPO3 Cross-Site Scripting vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors can insert javascript commands by using the url scheme `javascript:`.
7.6.1
Affected by 87 other vulnerabilities.
VCID-y93e-ckjh-wqea
Aliases:
2015-07-01-4
Information Disclosure possibility exploitable by Editors.
7.3.0
Affected by 53 other vulnerabilities.
VCID-ype3-tase-wue6
Aliases:
GMS-2015-25
Unauthenticated Path Disclosure It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation.
7.4.0
Affected by 44 other vulnerabilities.
VCID-yq8z-3ahh-1kbj
Aliases:
GHSA-4r76-xr68-w7m7
TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
7.3.1
Affected by 47 other vulnerabilities.
VCID-yx78-xb3g-yfan
Aliases:
CVE-2015-8755
GHSA-56f9-5563-m2h7
Typo3 XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
7.6.1
Affected by 87 other vulnerabilities.
VCID-zrsh-tk2s-2uhm
Aliases:
2015-12-15-1
Cross-site Scripting Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend.
7.6.1
Affected by 87 other vulnerabilities.
VCID-zzxz-2f13-qyhn
Aliases:
TYPO3-CORE-SA-2016-013
Missing Access Check Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.
7.6.8
Affected by 70 other vulnerabilities.
8.1.1
Affected by 112 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-2ypz-t2ty-c3e3 Typo3 Cross-Site Scripting in Flash component (ELTS) TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external component, which could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. CVE-2020-8091
GHSA-qvhv-pwww-53jj

Date Actor Action Vulnerability Source VulnerableCode Version
2025-07-03T19:07:33.997207+00:00 GitLab Importer Affected by VCID-mgtw-94ks-a7du https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-f777-f784-36gm.yml 37.0.0
2025-07-03T19:07:33.187811+00:00 GitLab Importer Affected by VCID-hdsj-ya24-9uhk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-g585-crjf-vhwq.yml 37.0.0
2025-07-03T19:07:32.223688+00:00 GitLab Importer Affected by VCID-fhr8-f4h5-6ffx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-7q33-hxwj-7p8v.yml 37.0.0
2025-07-03T19:07:30.736250+00:00 GitLab Importer Affected by VCID-mpuk-6hdb-sqh7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-6487-3qvg-8px9.yml 37.0.0
2025-07-03T19:07:26.997596+00:00 GitLab Importer Affected by VCID-4zub-buj2-5kbh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-f3wf-q4fj-3gxf.yml 37.0.0
2025-07-03T19:07:26.497897+00:00 GitLab Importer Affected by VCID-4mfu-2wkc-ybbw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-8m6j-p5jv-v69w.yml 37.0.0
2025-07-03T19:07:25.724654+00:00 GitLab Importer Affected by VCID-ukvt-pj2t-9kcq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-2rcw-9hrm-8q7q.yml 37.0.0
2025-07-03T19:07:03.397711+00:00 GitLab Importer Affected by VCID-w2qy-69nb-5ke5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-ppgf-8745-8pgx.yml 37.0.0
2025-07-03T19:06:57.332467+00:00 GitLab Importer Affected by VCID-mf9a-exme-b3ca https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-6f9m-v7mp-7jjq.yml 37.0.0
2025-07-03T19:06:46.306488+00:00 GitLab Importer Affected by VCID-u4n4-rh2y-8ycg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-6fc6-cj2j-h22x.yml 37.0.0
2025-07-03T19:06:45.448131+00:00 GitLab Importer Affected by VCID-k7zv-e4ez-dbaz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-5cxf-xx9j-54jc.yml 37.0.0
2025-07-03T19:06:24.861934+00:00 GitLab Importer Affected by VCID-yq8z-3ahh-1kbj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-4r76-xr68-w7m7.yml 37.0.0
2025-07-03T19:06:23.219651+00:00 GitLab Importer Affected by VCID-jyxd-d6ce-7qd9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-r287-hc8j-w56h.yml 37.0.0
2025-07-03T19:06:23.009080+00:00 GitLab Importer Affected by VCID-n14c-7g17-qudk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-r9vc-jfmh-6j48.yml 37.0.0
2025-07-03T19:06:22.596669+00:00 GitLab Importer Affected by VCID-y8va-79qc-97cc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-75mx-chcf-2q32.yml 37.0.0
2025-07-03T19:06:22.221620+00:00 GitLab Importer Affected by VCID-maa6-4fkn-pqhz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-jqr8-q455-xx45.yml 37.0.0
2025-07-03T19:06:21.996944+00:00 GitLab Importer Affected by VCID-nnxd-zjsh-wqbp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-wp8j-c736-c5r3.yml 37.0.0
2025-07-03T19:06:19.413574+00:00 GitLab Importer Affected by VCID-kktc-18fc-cuar https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-pqfv-97hj-g97g.yml 37.0.0
2025-07-03T18:36:13.668328+00:00 GitLab Importer Affected by VCID-kh9n-kuvd-pbat https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-23501.yml 37.0.0
2025-07-03T18:30:22.032310+00:00 GitLab Importer Affected by VCID-w2hv-ftte-fyd1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-36107.yml 37.0.0
2025-07-03T18:30:20.053052+00:00 GitLab Importer Affected by VCID-xww9-ktn9-e3ga https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-36105.yml 37.0.0
2025-07-03T18:25:47.240157+00:00 GitLab Importer Affected by VCID-q2ch-qd6x-vqeu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-31047.yml 37.0.0
2025-07-03T18:19:18.181240+00:00 GitLab Importer Affected by VCID-yx78-xb3g-yfan https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2015-8755.yml 37.0.0
2025-07-03T18:18:48.678002+00:00 GitLab Importer Affected by VCID-rnen-s5y6-8yg1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2015-8759.yml 37.0.0
2025-07-03T18:16:53.760174+00:00 GitLab Importer Affected by VCID-w5s9-wjpe-bkc1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2013-7341.yml 37.0.0
2025-07-03T18:02:44.317650+00:00 GitLab Importer Affected by VCID-tvq8-qbwc-qkfs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-32768.yml 37.0.0
2025-07-03T18:02:18.289450+00:00 GitLab Importer Affected by VCID-rmnv-emnu-6bfy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-32767.yml 37.0.0
2025-07-03T17:56:43.240712+00:00 GitLab Importer Affected by VCID-d42j-347n-e7en https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21338.yml 37.0.0
2025-07-03T17:56:28.096168+00:00 GitLab Importer Affected by VCID-ekj9-nhu4-93cc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21370.yml 37.0.0
2025-07-03T17:56:25.858779+00:00 GitLab Importer Affected by VCID-v83x-2hx7-yycg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21339.yml 37.0.0
2025-07-03T17:38:19.096158+00:00 GitLab Importer Fixing VCID-2ypz-t2ty-c3e3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2020-8091.yml 37.0.0
2025-07-03T17:37:57.425364+00:00 GitLab Importer Affected by VCID-8mc9-ye3u-c3aj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2019-19849.yml 37.0.0
2025-07-03T17:37:55.962193+00:00 GitLab Importer Affected by VCID-hg6g-kn76-bfbh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2019-19848.yml 37.0.0
2025-07-03T17:30:48.027111+00:00 GitLab Importer Affected by VCID-xsd3-6zyc-j7dg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-4.yml 37.0.0
2025-07-03T17:30:47.725221+00:00 GitLab Importer Affected by VCID-7yn7-f2cw-ukfj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-6.yml 37.0.0
2025-07-03T17:30:46.764651+00:00 GitLab Importer Affected by VCID-8re4-c6j8-hyfh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-7.yml 37.0.0
2025-07-03T17:30:46.069656+00:00 GitLab Importer Affected by VCID-53bg-1gfq-7bap https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-2.yml 37.0.0
2025-07-03T17:30:45.582696+00:00 GitLab Importer Affected by VCID-fj4s-fcy4-2fcj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-1.yml 37.0.0
2025-07-03T17:30:45.273600+00:00 GitLab Importer Affected by VCID-hrjb-bbbx-1kbq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-5.yml 37.0.0
2025-07-03T17:30:44.511811+00:00 GitLab Importer Affected by VCID-1txn-xjt1-37ha https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-3.yml 37.0.0
2025-07-03T17:27:55.988426+00:00 GitLab Importer Affected by VCID-cvpr-b5np-6bcv https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-07-12-1.yml 37.0.0
2025-07-03T17:27:54.292955+00:00 GitLab Importer Affected by VCID-n7ha-dtwq-xqf9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-07-12-2.yml 37.0.0
2025-07-03T17:23:52.019496+00:00 GitLab Importer Affected by VCID-jtuy-ex79-tfbu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2018-6905.yml 37.0.0
2025-07-03T17:16:17.874037+00:00 GitLab Importer Affected by VCID-f6sb-d831-u3fh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2016-021.yml 37.0.0
2025-07-03T17:16:17.591554+00:00 GitLab Importer Affected by VCID-ky6n-ka2n-ayhu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2016-022.yml 37.0.0
2025-07-03T17:14:57.270188+00:00 GitLab Importer Affected by VCID-zzxz-2f13-qyhn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2016-013.yml 37.0.0
2025-07-03T17:14:01.281097+00:00 GitLab Importer Affected by VCID-zrsh-tk2s-2uhm https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-12-15-1.yml 37.0.0
2025-07-03T17:14:00.599705+00:00 GitLab Importer Affected by VCID-33h5-eea4-rben https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-12-15-2.yml 37.0.0
2025-07-03T17:14:00.404174+00:00 GitLab Importer Affected by VCID-2k75-zp2r-67da https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2015-012.yml 37.0.0
2025-07-03T17:13:58.012883+00:00 GitLab Importer Affected by VCID-af14-5ttt-t7ac https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2015-011.yml 37.0.0
2025-07-03T17:13:57.538548+00:00 GitLab Importer Affected by VCID-dkr9-d6n6-puf5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2015-013.yml 37.0.0
2025-07-03T17:13:56.756317+00:00 GitLab Importer Affected by VCID-c9g4-gcfy-8ug4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-12-15-3.yml 37.0.0
2025-07-03T17:13:40.753960+00:00 GitLab Importer Affected by VCID-cwsm-v895-nqc7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2015-5956.yml 37.0.0
2025-07-03T17:13:38.735846+00:00 GitLab Importer Affected by VCID-7rqj-m3xh-5uam https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-09-08-1.yml 37.0.0
2025-07-03T17:13:38.541514+00:00 GitLab Importer Affected by VCID-ype3-tase-wue6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GMS-2015-25.yml 37.0.0
2025-07-03T17:13:31.001478+00:00 GitLab Importer Affected by VCID-wvzh-uxhw-g3d5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-07-01-3.yml 37.0.0
2025-07-03T17:13:30.818421+00:00 GitLab Importer Affected by VCID-dwrf-me8a-z7fa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-07-01-1.yml 37.0.0
2025-07-03T17:13:30.629033+00:00 GitLab Importer Affected by VCID-7hxf-mt3r-6bag https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-07-01-6.yml 37.0.0
2025-07-03T17:13:30.448695+00:00 GitLab Importer Affected by VCID-rf5y-9xhy-ckhk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-07-01-5.yml 37.0.0
2025-07-03T17:13:30.268557+00:00 GitLab Importer Affected by VCID-urhg-ftwf-pubr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-07-01-2.yml 37.0.0
2025-07-03T17:13:30.072502+00:00 GitLab Importer Affected by VCID-y93e-ckjh-wqea https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2015-07-01-4.yml 37.0.0
2025-07-03T13:54:58.822612+00:00 GitLab Importer Fixing VCID-2ypz-t2ty-c3e3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2020-8091.yml 36.1.3
2025-07-01T12:29:05.503041+00:00 GithubOSV Importer Fixing VCID-2ypz-t2ty-c3e3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qvhv-pwww-53jj/GHSA-qvhv-pwww-53jj.json 36.1.3