Search for packages
| purl | pkg:composer/typo3/cms@6.2.19 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2m7w-zfua-u7b9
Aliases: GHSA-g4pf-3jvq-2gcw |
TYPO3 Remote Code Execution in third party library swiftmailer TYPO3 uses the package swiftmailer/swiftmailer for mail actions. This package is known to be vulnerable to Remote Code Execution. |
Affected by 8 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 94 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2ypz-t2ty-c3e3
Aliases: CVE-2020-8091 GHSA-qvhv-pwww-53jj |
Typo3 Cross-Site Scripting in Flash component (ELTS) TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external component, which could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. |
Affected by 0 other vulnerabilities. Affected by 60 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-3yjx-zkmc-zkau
Aliases: 2016-04-12-4 |
Improper Privilege Management Privilege Escalation in TYPO3 CMS. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 73 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 115 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-5m4k-jd3r-abaf
Aliases: GHSA-gj48-w74w-8gvm GMS-2024-342 |
Path Traversal in TYPO3 Core Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence. |
Affected by 10 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 46 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6bne-vnc6-wfe9
Aliases: 2016-07-19-5 |
Cross-site Scripting Cross-Site Scripting vulnerability in typolinks. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-8a25-9af4-tyhk
Aliases: GHSA-xvcp-33rc-j8gq |
Insecure Unserialize in TYPO3 Import/Export Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-8fkz-6kqu-gqbk
Aliases: TYPO3-CORE-SA-2016-024 |
Path Traversal Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence. |
Affected by 10 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 46 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-8jv7-9a74-q3ee
Aliases: 2016-04-12-1 |
Cross-site Scripting Cross-Site Scripting in TYPO3 Backend. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 73 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 115 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-8mc9-ye3u-c3aj
Aliases: CVE-2019-19849 GHSA-rcgc-4xfc-564v |
TYPO3 Insecure Deserialization in Query Generator & Query View An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges. |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-a8wf-nz2q-s3gh
Aliases: GHSA-gwfx-p7mr-f92v |
Missing Access Check in TYPO3 CMS Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute. |
Affected by 32 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 70 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 112 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-aujs-m8j8-guh1
Aliases: 2016-05-24-1 |
Improper Access Control Missing Access Check in TYPO3 CMS. |
Affected by 32 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 70 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 112 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-axg7-qg5u-kbg7
Aliases: GHSA-86r8-4g3w-7xjp |
Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-bd6u-nca5-gyeu
Aliases: GHSA-hq37-rfjc-mr8h |
Cross-Site Scripting (XSS) in TYPO3 Backend Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability. |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 52 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-cdkv-3rbf-27ed
Aliases: 2016-07-19-4 |
Information Disclosure in TYPO3 Backend. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-cnqq-fdxb-9uat
Aliases: GHSA-c7rj-92xr-wprg |
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed. |
Affected by 10 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 46 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-d2qd-qjn9-jffs
Aliases: 2016-07-19-1 |
Cross-site Scripting Cross-Site Scripting in TYPO3 Backend. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-d381-rcq3-n3az
Aliases: GHSA-vpr3-rc99-2wpr |
Information Disclosure in TYPO3 Backend The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-d42j-347n-e7en
Aliases: CVE-2021-21338 GHSA-4jhw-2p6j-5wmp |
Open Redirection in Login Handling ### Problem It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. ### Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. ### References * [TYPO3-CORE-SA-2021-001](https://typo3.org/security/advisory/typo3-core-sa-2021-001) |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability.
This version is affected by these other vulnerabilities:
Affected by 3 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 12 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 22 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-dm6k-fzm6-sqbe
Aliases: GHSA-p5c5-gmj4-g48f |
Cross-Site Scripting (XSS) vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors can insert data commands by using the url scheme "data:". |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-e5ns-2x1v-sbaj
Aliases: TYPO3-CORE-SA-2016-023 |
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed. |
Affected by 10 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 46 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-f6sb-d831-u3fh
Aliases: TYPO3-CORE-SA-2016-021 |
Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability. |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 52 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-fehf-p36x-wfha
Aliases: 2016-04-12-2 |
Information Exposure Arbitrary File Disclosure in Form Component. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-gb7f-4sm6-tkaw
Aliases: 2016-09-14-2 |
Uncontrolled Resource Consumption Cache Flooding in TYPO3 Frontend. |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 52 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 102 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-heyp-4b45-v7gp
Aliases: 2016-11-22-1 |
Insecure Deserialization Insecure Unserialize in TYPO3 Backend. |
Affected by 10 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 46 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-hg6g-kn76-bfbh
Aliases: CVE-2019-19848 GHSA-77p4-wfr8-977w |
TYPO3 Directory Traversal on ZIP extraction An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.) |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-htsn-wq8h-qbgp
Aliases: 2017-01-03-1 |
Code Injection Remote Code Execution in third party library swiftmailer. |
Affected by 8 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 95 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-j1nq-26xv-yff3
Aliases: GHSA-j86x-pjmr-9m6w |
SQL Injection in TYPO3 Frontend Login Failing to properly escape user input, the frontend login component is vulnerable to SQL Injection. A valid frontend user account is needed to exploit this vulnerability. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-jtuy-ex79-tfbu
Aliases: CVE-2018-6905 GHSA-3w22-wrwx-2r75 |
Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process. |
Affected by 76 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-k8yx-gezq-7fd6
Aliases: GHSA-6xh8-8pfv-53vx |
Authentication Bypass in TYPO3 CMS The default authentication service misses to invalidate empty strings as password. Therefore it is possible to authenticate backend and frontend users without password set in the database. Note: TYPO3 does not allow to create user accounts without a password. Your TYPO3 installation might only be affected if there is a third party component creating user accounts without password by directly manipulating the database. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 73 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 115 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-kh9n-kuvd-pbat
Aliases: CVE-2022-23501 GHSA-jfp7-79g7-89rf |
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login ### Problem Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. ### Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. ### References * [TYPO3-CORE-SA-2022-013](https://typo3.org/security/advisory/typo3-core-sa-2022-013) |
Affected by 1 other vulnerability.
This version is affected by these other vulnerabilities:
Affected by 1 other vulnerability.
This version is affected by these other vulnerabilities:
Affected by 1 other vulnerability.
This version is affected by these other vulnerabilities:
|
|
VCID-ky6n-ka2n-ayhu
Aliases: TYPO3-CORE-SA-2016-022 |
Cache Flooding in Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack. |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 52 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-m3gb-henf-4uga
Aliases: 2016-07-19-3 |
SQL Injection in TYPO3 Frontend Login. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-psu6-y6fc-nqh4
Aliases: 2016-07-19-2 |
Deserialization of Untrusted Data Insecure Unserialize in TYPO3 Import/Export. |
Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 56 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rtd6-q7tg-ykfh
Aliases: CVE-2020-26227 GHSA-vqqx-jw6p-q3rf |
Cross-Site Scripting in Fluid view helpers > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) > * CWE-79 ### Problem It has been discovered that system extension Fluid (`typo3/cms-fluid`) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. ``` <f:form ... fieldNamePrefix="{payload}" /> <f:be.labels.csh ... label="{payload}" /> <f:be.menus.actionMenu ... label="{payload}" /> ``` ### Solution Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described. ### Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2020-010](https://typo3.org/security/advisory/typo3-core-sa-2020-010) |
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 18 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-t352-87cy-4qhm
Aliases: GHSA-pw2q-qwvj-gh43 |
Cache Flooding in TYPO3 Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack. |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 52 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-t7fe-ph2m-j3e5
Aliases: 2016-09-14-1 |
Cross-site Scripting XSS in TYPO3 Backend. |
Affected by 16 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 52 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 102 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-v83x-2hx7-yycg
Aliases: CVE-2021-21339 GHSA-qx3w-4864-94ch |
Cleartext storage of session identifier ### Problem User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. ### Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2021-006](https://typo3.org/security/advisory/typo3-core-sa-2021-006) |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability.
This version is affected by these other vulnerabilities:
Affected by 3 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 12 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 22 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-vujd-b56y-8kfk
Aliases: GHSA-v5jp-4h2p-j2p4 |
Privilege Escalation in TYPO3 CMS The workspace/ version preview link created by a privileged (backend) user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 73 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 115 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-x5wu-b995-xkcm
Aliases: 2016-04-12-3 |
Improper Authentication Authentication Bypass in TYPO3 CMS. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 73 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 115 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-y15u-f9e9-akff
Aliases: 2016-11-22-2 |
Path Traversal in TYPO3 Core. |
Affected by 10 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 64 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 46 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 92 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-z5h8-5shq-kbgh
Aliases: GHSA-wrpf-2x8h-82gr |
Typo3 Arbitrary File Disclosure in Form Component Failing to properly validate user input, the form component is susceptible to Arbitrary File Disclosure. A valid backend user account is needed to exploit this vulnerability. Only forms are vulnerable, which contain upload fields. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zu53-dnd1-h3gu
Aliases: GHSA-5wx6-xwxf-q8qj |
Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability. |
Affected by 35 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 73 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 115 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zzxz-2f13-qyhn
Aliases: TYPO3-CORE-SA-2016-013 |
Missing Access Check Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute. |
Affected by 33 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 70 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 112 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-18bd-kv2y-jkfw | Cross-Site Scripting (XSS) in TYPO3 component Backend Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site Scripting. |
GHSA-3jxq-5xhh-9jr3
|
| VCID-1u6q-5rdj-abdb | XML External Entity (XXE) Processing in TYPO3 Core All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing. |
GHSA-qffc-gwpp-m2xr
|
| VCID-4phm-hhrx-kkc7 | TYPO3 Backend component Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark. |
CVE-2016-4056
GHSA-ffcm-vhcw-p32r |
| VCID-8wyj-vv9y-jbhp | Cross-Site Scripting (XSS) in TYPO3 component CSS styled content Failing to properly encode user input, the CSS styled content component is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript. |
GHSA-8j9v-4hhh-x43c
|
| VCID-bfg8-yh9h-5kce | Uncontrolled Resource Consumption Denial of Service attack possibility in TYPO3 component Indexed Search. |
2016-02-23-4
|
| VCID-ej97-kcp8-hffu | Cross-site Scripting Cross-Site Scripting in TYPO3 component Backend. |
2016-02-23-2
|
| VCID-hbzu-v4jk-hyhd | Improper Restriction of XML External Entity Reference XML External Entity (XXE) Processing in TYPO3 Core. |
2016-02-23-1
|
| VCID-krcw-y6kx-37br | Cross-site Scripting Cross-Site Scripting in TYPO3 component CSS styled content. |
2016-02-23-3
|
| VCID-xh3z-5w6z-ducr | Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search Due to an oversized maximum result limit, TYPO3 component Indexed Search is susceptible to a Denial of Service attack. |
GHSA-pmxp-7224-h794
|