Search for packages
Package details: pkg:composer/typo3/cms@8.2.0
purl pkg:composer/typo3/cms@8.2.0
Next non-vulnerable version 10.4.35
Latest non-vulnerable version 12.2.0
Risk 4.0
Vulnerabilities affecting this package (114)
Vulnerability Summary Fixed by
VCID-17h4-rww9-93ad
Aliases:
2019-01-22-3
Improper Access Control Broken Access Control in Localization Handling.
8.7.23
Affected by 38 other vulnerabilities.
9.0.0
Affected by 95 other vulnerabilities.
VCID-1d1x-7vx6-zbfw
Aliases:
CVE-2017-14251
GHSA-fh4q-hxrw-cjqq
TYPO3 Arbitrary Code Execution Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.
8.7.5
Affected by 77 other vulnerabilities.
VCID-1txn-xjt1-37ha
Aliases:
2018-12-11-3
Cross-site Scripting Cross-Site Scripting in Frontend User Login.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-24z2-dffm-wfdf
Aliases:
GHSA-g9rv-6g56-65h8
Typo3 Security Misconfiguration in User Session Handling When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability.
8.7.25
Affected by 34 other vulnerabilities.
9.5.6
Affected by 48 other vulnerabilities.
VCID-2m7w-zfua-u7b9
Aliases:
GHSA-g4pf-3jvq-2gcw
TYPO3 Remote Code Execution in third party library swiftmailer TYPO3 uses the package swiftmailer/swiftmailer for mail actions. This package is known to be vulnerable to Remote Code Execution.
8.5.1
Affected by 94 other vulnerabilities.
VCID-2pbg-f35b-jyaa
Aliases:
2017-02-28-1
Improper Authentication Authentication Bypass in TYPO3 Frontend.
8.6.1
Affected by 88 other vulnerabilities.
VCID-2x7t-5tdv-cuge
Aliases:
TYPO3-CORE-SA-2017-004
XSS Vulnerability Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
8.7.5
Affected by 77 other vulnerabilities.
VCID-3c1n-du49-6bes
Aliases:
CVE-2016-5385
GHSA-m6ch-gg5f-wxx3
8.2.1
Affected by 100 other vulnerabilities.
VCID-3vjn-rrkb-nbbw
Aliases:
GHSA-8h4m-r4wm-xj7r
TYPO3 Arbitrary Code Execution via File List Module Due to missing file extensions in $GLOBALS['TYPO3_CONF_VARS']['BE'][‘fileDenyPattern’], backend users are allowed to upload *.phar, *.shtml, *.pl or *.cgi files which can be executed in certain web server setups. A valid backend user account is needed in order to exploit this vulnerability. Derivatives of Debian GNU Linux are handling *.phar files as PHP applications since PHP 7.1 (for unofficial packages) and PHP 7.2 (for official packages). The file extension *.shtml is bound to server side includes which are not enabled per default in most common Linux based distributions. File extension *.pl and *.cgi require additional handlers to be configured which is also not the case in most common distributions (except for /cgi-bin/ location).
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-3wq5-qkuj-c7ce
Aliases:
GHSA-hww5-6x85-mc24
Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings. A valid backend user account having access to modify values for fields pages.TSconfig and pages.tsconfig_includes is needed in order to exploit this vulnerability.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-4mfu-2wkc-ybbw
Aliases:
GHSA-8m6j-p5jv-v69w
TYPO3 Cross-Site Scripting in Online Media Asset Rendering Failing to properly encode user input, online media asset rendering (`*.youtube` and `*.vimeo` files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-4zub-buj2-5kbh
Aliases:
GHSA-f3wf-q4fj-3gxf
TYPO3 Denial of Service in Online Media Asset Handling Online Media Asset Handling (*`.youtube` and *`.vimeo` files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-53bg-1gfq-7bap
Aliases:
2018-12-11-2
Cross-site Scripting Cross-Site Scripting in Backend Modal Component.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-56yk-z25r-nuap
Aliases:
GHSA-g7hw-jh4p-75wr
TYPO3 Cross-Site Scripting in Filelist Module It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the vulnerability.
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.1
Affected by 41 other vulnerabilities.
VCID-58sc-bkhd-7ud1
Aliases:
2017-09-05-4
Code Injection Arbitrary Code Execution in TYPO3 CMS.
8.7.0
Affected by 87 other vulnerabilities.
VCID-5m4k-jd3r-abaf
Aliases:
GHSA-gj48-w74w-8gvm
GMS-2024-342
Path Traversal in TYPO3 Core Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence.
8.4.1
Affected by 92 other vulnerabilities.
VCID-6bne-vnc6-wfe9
Aliases:
2016-07-19-5
Cross-site Scripting Cross-Site Scripting vulnerability in typolinks.
8.2.1
Affected by 100 other vulnerabilities.
VCID-7hee-5tpj-g7ct
Aliases:
GHSA-f624-8hfq-5fh3
TYPO3 Information Disclosure of Installed Extensions It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-7vrs-6mah-2fh9
Aliases:
CVE-2021-32668
GHSA-6mh3-j5r5-2379
Cross-Site Scripting in Query Generator & Query View > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5) ### Problem Failing to properly encode error messages, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. ### Solution Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. ### Credits Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2021-010](https://typo3.org/security/advisory/typo3-core-sa-2021-010)
9.5.28
Affected by 10 other vulnerabilities.
10.4.18
Affected by 18 other vulnerabilities.
11.3.1
Affected by 20 other vulnerabilities.
VCID-7yn7-f2cw-ukfj
Aliases:
2018-12-11-6
Uncontrolled Resource Consumption Denial of Service in Online Media Asset Handling.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-7yrw-wj9m-hkd4
Aliases:
2017-02-28-2
Cross-site Scripting XSS in TYPO3 CMS.
8.6.1
Affected by 88 other vulnerabilities.
VCID-7zyp-yza7-2udn
Aliases:
2019-05-07-2
Security Misconfiguration in User Session Handling.
8.7.25
Affected by 34 other vulnerabilities.
9.5.6
Affected by 48 other vulnerabilities.
VCID-8a25-9af4-tyhk
Aliases:
GHSA-xvcp-33rc-j8gq
Insecure Unserialize in TYPO3 Import/Export Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
8.2.1
Affected by 100 other vulnerabilities.
VCID-8fkz-6kqu-gqbk
Aliases:
TYPO3-CORE-SA-2016-024
Path Traversal Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence.
8.4.1
Affected by 92 other vulnerabilities.
VCID-8mc9-ye3u-c3aj
Aliases:
CVE-2019-19849
GHSA-rcgc-4xfc-564v
TYPO3 Insecure Deserialization in Query Generator & Query View An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.1
Affected by 41 other vulnerabilities.
10.2.2
Affected by 41 other vulnerabilities.
VCID-8re4-c6j8-hyfh
Aliases:
2018-12-11-7
Uncontrolled Resource Consumption Denial of Service in Frontend Record Registration.
8.7.21
Affected by 51 other vulnerabilities.
9.0.0
Affected by 95 other vulnerabilities.
VCID-8u66-mv4d-zbd4
Aliases:
2019-01-22-6
Cross-site Scripting Cross-Site Scripting in Form Framework.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-a6c5-ytdy-3qh4
Aliases:
GHSA-5gr6-97fv-52cc
Cross-Site Scripting in TYPO3 CMS Failing to properly encode user input, several places of the TYPO3 CMS are vulnerable to Cross-Site Scripting.
8.6.1
Affected by 88 other vulnerabilities.
VCID-aj9w-bguk-9yek
Aliases:
2019-06-25-5
Insecure Deserialization in TYPO3 CMS.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-axg7-qg5u-kbg7
Aliases:
GHSA-86r8-4g3w-7xjp
Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
8.2.1
Affected by 100 other vulnerabilities.
VCID-bd6u-nca5-gyeu
Aliases:
GHSA-hq37-rfjc-mr8h
Cross-Site Scripting (XSS) in TYPO3 Backend Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability.
8.3.1
Affected by 98 other vulnerabilities.
VCID-bgk1-npak-uuhy
Aliases:
GHSA-qr5f-6fcv-w69q
Typo3 Security Misconfiguration in Frontend Session Handling It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-brcm-16va-3yek
Aliases:
GHSA-c7p6-3c9c-f88q
Information Disclosure in TYPO3 CMS HTTP requests being performed using the TYPO3 API expose the specific TYPO3 version to the called endpoint.
8.7.5
Affected by 77 other vulnerabilities.
VCID-bvjs-f141-sfc7
Aliases:
2019-06-25-1
Information Disclosure in Backend User Interface.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-cdkv-3rbf-27ed
Aliases:
2016-07-19-4
Information Disclosure in TYPO3 Backend.
8.2.1
Affected by 100 other vulnerabilities.
VCID-cnqq-fdxb-9uat
Aliases:
GHSA-c7rj-92xr-wprg
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
8.4.1
Affected by 92 other vulnerabilities.
VCID-ct1e-wck2-6qbj
Aliases:
2017-09-05-1
Cross-site Scripting XSS in TYPO3 CMS Backend.
8.7.0
Affected by 87 other vulnerabilities.
VCID-cvpr-b5np-6bcv
Aliases:
2018-07-12-1
Improper Authentication Authentication Bypass in TYPO3 CMS.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-cxp1-whzb-p7hy
Aliases:
GHSA-v8m4-3w37-ghxx
TYPO3 Cross-Site Scripting in Form Framework validation handling It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting.
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.1
Affected by 41 other vulnerabilities.
VCID-d2qd-qjn9-jffs
Aliases:
2016-07-19-1
Cross-site Scripting Cross-Site Scripting in TYPO3 Backend.
8.2.1
Affected by 100 other vulnerabilities.
VCID-d381-rcq3-n3az
Aliases:
GHSA-vpr3-rc99-2wpr
Information Disclosure in TYPO3 Backend The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames.
8.2.1
Affected by 100 other vulnerabilities.
VCID-d42j-347n-e7en
Aliases:
CVE-2021-21338
GHSA-4jhw-2p6j-5wmp
Open Redirection in Login Handling ### Problem It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. ### Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. ### References * [TYPO3-CORE-SA-2021-001](https://typo3.org/security/advisory/typo3-core-sa-2021-001)
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-dc9k-gxr2-6bah
Aliases:
2016-07-19-7
Cross-site Scripting Cross-Site Scripting in third party library `mso/idna-convert`.
8.2.1
Affected by 100 other vulnerabilities.
VCID-dfng-qmn8-jyc5
Aliases:
2019-01-22-2
Security Misconfiguration for Backend User Accounts.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-dkmy-bwds-s7f4
Aliases:
2019-05-07-1
Cross-site Scripting Cross-Site Scripting in Fluid Engine.
8.7.25
Affected by 34 other vulnerabilities.
9.5.6
Affected by 48 other vulnerabilities.
VCID-dm6k-fzm6-sqbe
Aliases:
GHSA-p5c5-gmj4-g48f
Cross-Site Scripting (XSS) vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors can insert data commands by using the url scheme "data:".
8.2.1
Affected by 100 other vulnerabilities.
VCID-e3gy-22s1-huhc
Aliases:
2019-01-22-1
Information Disclosure of Installed Extensions.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-e5ns-2x1v-sbaj
Aliases:
TYPO3-CORE-SA-2016-023
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
8.4.1
Affected by 92 other vulnerabilities.
VCID-ekj9-nhu4-93cc
Aliases:
CVE-2021-21370
GHSA-x7hc-x7fm-f7qh
Cross-Site Scripting in Content Preview (CType menu) ### Problem It has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. ### Solution Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue. ### References * [TYPO3-CORE-SA-2021-008](https://typo3.org/security/advisory/typo3-core-sa-2021-008)
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-f6sb-d831-u3fh
Aliases:
TYPO3-CORE-SA-2016-021
Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability.
8.3.1
Affected by 98 other vulnerabilities.
VCID-f9e5-am8t-j7gc
Aliases:
CVE-2019-11832
GHSA-3w4h-r27h-4r2w
TYPO3 Image Processing susceptible to Code Execution TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary `gs` must be available on the server system.
8.7.25
Affected by 34 other vulnerabilities.
9.5.6
Affected by 48 other vulnerabilities.
VCID-fbhh-atu7-e3da
Aliases:
CVE-2021-21355
GHSA-2r6j-862c-m2v2
Unrestricted File Upload in Form Framework ### Problem Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. TYPO3 Extbase extensions, which implement a file upload and do not implement a custom _TypeConverter_ to transform uploaded files into _FileReference_ domain model objects are affected by the vulnerability as well, since the _UploadedFileReferenceConverter_ of _ext:form_ handles the file upload and will accept files of any mime-type which are persisted to the default location. In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exploit this vulnerability. ### Solution Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Type converter _UploadedFileReferenceConverter_ is not registered globally anymore and just handles uploaded files within the scope of the Form Framework. Guessable storage location has changed from _/fileadmin/user_upload/form\_\<random-hash\>/_ to _/fileadmin/form_uploads/<random-40-bit>_. Allowed mime-types must match expected file extensions (e.g. _application/pdf_ must be _.pdf_, and cannot be _.html_). Extbase extensions, who rely on the global availability of the _UploadedFileReferenceConverter_ must now implement a custom _TypeConverter_ to handle file uploads or explicitly implement the ext:form _UploadedFileReferenceConverter_ with appropriate setting for accepted mime-types. ### Credits Thanks to Sebastian Michaelsen, Marc Lindemann, Oliver Eglseder, Markus Volkmer, Jakob Kunzmann, Johannes Regner, Richie Lee who reported this issue, and to TYPO3 core & security team members Oliver Hader & Benni Mack, as well as TYPO3 contributor Ralf Zimmermann who fixed the issue. ### References * [TYPO3-CORE-SA-2021-002](https://typo3.org/security/advisory/typo3-core-sa-2021-002)
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-fhr8-f4h5-6ffx
Aliases:
GHSA-7q33-hxwj-7p8v
TYPO3 Cross-Site Scripting in Backend Modal Component Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-fj4s-fcy4-2fcj
Aliases:
2018-12-11-1
Cross-site Scripting Cross-Site Scripting in Online Media Asset Rendering.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-fru4-hjhx-47ev
Aliases:
TYPO3-CORE-SA-2017-006
Information Disclosure HTTP requests being performed using the TYPO3 API expose the specific TYPO3 version to the called endpoint.
8.7.5
Affected by 77 other vulnerabilities.
VCID-g8w9-nj7c-dfa4
Aliases:
GHSA-c5mj-39cf-3pp5
TYPO3 Security Misconfiguration for Backend User Accounts When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in order to reflect changed configuration possibilities. However, this leads to persisting the current state as well, which can result into some of the following: - account contains empty login credentials (username and/or password) - account is incomplete and contains weak credentials (username and/or password) Albeit the functionality provided by the TYPO3 core cannot be used either with empty usernames or empty passwords, it still can be a severe vulnerability to custom authentication service implementations. This weakness cannot be directly exploited and requires interaction on purpose by some backend user having according privileges.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-gb7f-4sm6-tkaw
Aliases:
2016-09-14-2
Uncontrolled Resource Consumption Cache Flooding in TYPO3 Frontend.
8.3.0
Affected by 102 other vulnerabilities.
VCID-hdsj-ya24-9uhk
Aliases:
GHSA-g585-crjf-vhwq
TYPO3 Denial of Service in Frontend Record Registration TYPO3’s built-in record registration functionality (aka `basic shopping cart`) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual session-data records in the database.
8.7.21
Affected by 51 other vulnerabilities.
VCID-heyp-4b45-v7gp
Aliases:
2016-11-22-1
Insecure Deserialization Insecure Unserialize in TYPO3 Backend.
8.4.1
Affected by 92 other vulnerabilities.
VCID-hg6g-kn76-bfbh
Aliases:
CVE-2019-19848
GHSA-77p4-wfr8-977w
TYPO3 Directory Traversal on ZIP extraction An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.2
Affected by 41 other vulnerabilities.
VCID-hrjb-bbbx-1kbq
Aliases:
2018-12-11-5
Information Disclosure in Install Tool.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-htsn-wq8h-qbgp
Aliases:
2017-01-03-1
Code Injection Remote Code Execution in third party library swiftmailer.
8.5.0
Affected by 95 other vulnerabilities.
VCID-hwcz-r4cu-9fba
Aliases:
TYPO3-CORE-SA-2017-003
XSS Vulnerability TYPO3 is vulnerable to Cross-Site Scripting.
8.6.1
Affected by 88 other vulnerabilities.
VCID-jtuy-ex79-tfbu
Aliases:
CVE-2018-6905
GHSA-3w22-wrwx-2r75
Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process.
8.7.11
Affected by 76 other vulnerabilities.
9.1.0
Affected by 92 other vulnerabilities.
9.2.0
Affected by 92 other vulnerabilities.
VCID-kh9n-kuvd-pbat
Aliases:
CVE-2022-23501
GHSA-jfp7-79g7-89rf
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login ### Problem Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. ### Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. ### References * [TYPO3-CORE-SA-2022-013](https://typo3.org/security/advisory/typo3-core-sa-2022-013)
10.4.33
Affected by 1 other vulnerability.
11.5.20
Affected by 1 other vulnerability.
12.1.1
Affected by 1 other vulnerability.
VCID-ks2k-ehk8-nqbm
Aliases:
CVE-2021-32669
GHSA-rgcg-28xm-8mmw
Cross-Site Scripting in Backend Grid View ### Problem Failing to properly encode settings for _backend layouts_, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. ### Solution Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. ### Credits Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.
9.5.28
Affected by 10 other vulnerabilities.
10.4.18
Affected by 18 other vulnerabilities.
11.3.1
Affected by 20 other vulnerabilities.
VCID-ky6n-ka2n-ayhu
Aliases:
TYPO3-CORE-SA-2016-022
Cache Flooding in Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack.
8.3.1
Affected by 98 other vulnerabilities.
VCID-mf9a-exme-b3ca
Aliases:
GHSA-6f9m-v7mp-7jjq
Authentication Bypass in TYPO3 CMS It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-mgtw-94ks-a7du
Aliases:
GHSA-f777-f784-36gm
TYPO3 Security Misconfiguration in Install Tool Cookie It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-mpuk-6hdb-sqh7
Aliases:
GHSA-6487-3qvg-8px9
TYPO3 Information Disclosure in Install Tool The Install Tool exposes the current TYPO3 version number to non-authenticated users.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-n7ha-dtwq-xqf9
Aliases:
2018-07-12-2
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-pe6b-ygxy-kqes
Aliases:
2019-01-22-4
Cross-site Scripting Cross-Site Scripting in Fluid `ViewHelpers`.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-psu6-y6fc-nqh4
Aliases:
2016-07-19-2
Deserialization of Untrusted Data Insecure Unserialize in TYPO3 Import/Export.
8.2.1
Affected by 100 other vulnerabilities.
VCID-pwe8-razn-buae
Aliases:
CVE-2018-17960
GHSA-g68x-vvqq-pvw3
Ckeditor XSS Vulnerability CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, it is recommended to upgrade to the latest editor version.
8.7.21
Affected by 51 other vulnerabilities.
9.0.0
Affected by 95 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-q2ch-qd6x-vqeu
Aliases:
CVE-2022-31047
GHSA-fh99-4pgr-8j99
Insertion of Sensitive Information into Log File in typo3/cms-core > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that system internal credentials or keys (e.g. database credentials) have been logged as plaintext in exception handlers, when logging the complete exception stack trace. ### Solution Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. ### Credits Thanks to Marco Huber who reported this issue and to TYPO3 security member Torben Hansen who fixed the issue. ### References * [TYPO3-CORE-SA-2022-002](https://typo3.org/security/advisory/typo3-core-sa-2022-002)
10.4.29
Affected by 12 other vulnerabilities.
11.5.11
Affected by 13 other vulnerabilities.
VCID-qj2p-m8ce-myb3
Aliases:
GHSA-85ch-44w7-rf32
TYPO3 Cross-Site Scripting in Fluid ViewHelpers Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-r9yp-177t-efc4
Aliases:
2019-01-22-7
Code Injection Arbitrary Code Execution via File List Module.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-rep9-2rxn-gfee
Aliases:
2019-05-07-3
Code Injection Possible Arbitrary Code Execution in Image Processing.
8.7.25
Affected by 34 other vulnerabilities.
9.5.6
Affected by 48 other vulnerabilities.
VCID-rk6h-431z-ubbk
Aliases:
CVE-2019-19850
GHSA-59pj-7mjh-4465
TYPO3 SQL Injection in low-level Query Generator An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.2
Affected by 41 other vulnerabilities.
VCID-rmnv-emnu-6bfy
Aliases:
CVE-2021-32767
GHSA-34fr-fhqr-7235
Information Disclosure in User Authentication > ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration. ### Solution Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. ### Credits Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue. ### References * [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)
9.5.28
Affected by 10 other vulnerabilities.
10.4.18
Affected by 18 other vulnerabilities.
11.3.1
Affected by 20 other vulnerabilities.
VCID-scue-m12x-nkf4
Aliases:
2017-09-05-3
Information Disclosure in TYPO3 CMS.
8.7.0
Affected by 87 other vulnerabilities.
VCID-smyk-z453-gyag
Aliases:
GHSA-772m-43f3-hmf8
TYPO3 Broken Access Control in Localization Handling It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.
8.7.23
Affected by 38 other vulnerabilities.
VCID-snd3-qpkk-8bb5
Aliases:
GHSA-q9c4-9v5m-597p
Typo3 Information Disclosure in Backend User Interface The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-t352-87cy-4qhm
Aliases:
GHSA-pw2q-qwvj-gh43
Cache Flooding in TYPO3 Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack.
8.3.1
Affected by 98 other vulnerabilities.
VCID-t7b2-114h-ekaw
Aliases:
2019-06-25-2
Cross-site Scripting Cross-Site Scripting in Link Handling.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-t7fe-ph2m-j3e5
Aliases:
2016-09-14-1
Cross-site Scripting XSS in TYPO3 Backend.
8.3.0
Affected by 102 other vulnerabilities.
VCID-tbp9-2rg8-u7bk
Aliases:
2019-06-25-4
Code Injection Arbitrary Code Execution and Cross-Site Scripting in Backend API.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-tdsj-15xc-x3ar
Aliases:
GHSA-qmwf-j7g7-f5jw
Cross-Site Scripting in third party library mso/idna-convert Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3_src sources folder in the document root.
8.2.1
Affected by 100 other vulnerabilities.
VCID-tfey-6228-tybz
Aliases:
2019-01-22-5
Cross-site Scripting Cross-Site Scripting in Bootstrap CSS toolkit.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-tvq8-qbwc-qkfs
Aliases:
CVE-2021-32768
GHSA-c5c9-8c6m-727v
Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality _[HTMLparser](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Htmlparser.html)_ do not consider all potentially malicious HTML tag & attribute combinations per default. In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. ### Solution Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above. Custom package _[typo3/html-sanitizer](https://github.com/TYPO3/html-sanitizer)_ - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios. During the frontend rendering process, sanitization is applied to the default TypoScript path `lib.parseFunc`, which is implicitly used by the Fluid view-helper instruction `f:format.html`. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding [ChangeLog documentation](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/9.5.x/Important-94484-IntroduceHTMLSanitizer.html). ### Credits Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue. ### References * [TYPO3-CORE-SA-2021-013](https://typo3.org/security/advisory/typo3-core-sa-2021-013)
8.7.42
Affected by 0 other vulnerabilities.
9.5.29
Affected by 7 other vulnerabilities.
10.4.19
Affected by 17 other vulnerabilities.
11.3.2
Affected by 19 other vulnerabilities.
VCID-tvtv-cfzc-z3d5
Aliases:
GHSA-xgmx-j3hv-jh9x
TYPO3 Cross-Site Scripting in Link Handling It has been discovered that `t3://` URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink.
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
10.2.1
Affected by 41 other vulnerabilities.
VCID-u34g-yks8-hbay
Aliases:
CVE-2018-14041
GHSA-pj7m-g53m-7638
Bootstrap Cross-site Scripting vulnerability In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-u3es-5tz4-ybfc
Aliases:
2019-06-25-3
Security Misconfiguration in Frontend Session Handling.
8.7.27
Affected by 23 other vulnerabilities.
9.5.8
Affected by 33 other vulnerabilities.
VCID-u6ar-3wzb-u3eg
Aliases:
GHSA-g46h-v2cc-6c94
Information Disclosure in TYPO3 CMS Failing to properly check user permission on file storages, editors could gain knowledge of protected storages and its folders as well as using them in a file collection being rendered in the frontend. A valid backend user account is needed to exploit this vulnerability.
8.7.5
Affected by 77 other vulnerabilities.
VCID-u8we-bkyu-83b8
Aliases:
CVE-2022-23503
GHSA-c5wx-6c2c-f7rm
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework ### Problem Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it was possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item (known as [`formDefinitionOverrides`](https://docs.typo3.org/c/typo3/cms-form/main/en-us/I/Concepts/FrontendRendering/Index.html#form-element-properties)) and a valid backend user account with access to the form module are needed to exploit this vulnerability. ### Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. ### References * [TYPO3-CORE-SA-2022-015](https://typo3.org/security/advisory/typo3-core-sa-2022-015)
10.4.33
Affected by 1 other vulnerability.
11.5.20
Affected by 1 other vulnerability.
12.1.1
Affected by 1 other vulnerability.
VCID-ukvt-pj2t-9kcq
Aliases:
GHSA-2rcw-9hrm-8q7q
TYPO3 Cross-Site Scripting in Frontend User Login Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template patterns that are affected are - ###FEUSER_[fieldName]### using system extension felogin - <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-ungm-t9nm-hyf8
Aliases:
2016-07-19-6
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Environment Variable Injection.
8.2.1
Affected by 100 other vulnerabilities.
VCID-uzut-7219-xkc1
Aliases:
TYPO3-CORE-SA-2017-002
Authentication Bypass Due to late TCA initialization the authentication service fails to restrict frontend user according to the validation rules. Therefore it is possible to authenticate restricted (e.g. disabled) frontend users.
8.6.1
Affected by 88 other vulnerabilities.
VCID-v83x-2hx7-yycg
Aliases:
CVE-2021-21339
GHSA-qx3w-4864-94ch
Cleartext storage of session identifier ### Problem User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. ### Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2021-006](https://typo3.org/security/advisory/typo3-core-sa-2021-006)
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-vftm-uyy7-63fb
Aliases:
2017-09-05-2
Information Disclosure in TYPO3 CMS.
8.7.0
Affected by 87 other vulnerabilities.
VCID-vyhd-x5fe-b3aj
Aliases:
TYPO3-CORE-SA-2017-005
Information Disclosure Failing to properly check user permission on file storages, editors could gain knowledge of protected storages and its folders as well as using them in a file collection being rendered in the frontend. A valid backend user account is needed to exploit this vulnerability.
8.7.5
Affected by 77 other vulnerabilities.
VCID-w2hv-ftte-fyd1
Aliases:
CVE-2022-36107
GHSA-9c6w-55cp-5w25
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0) ### Problem It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. ### Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. ### Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2022-009](https://typo3.org/security/advisory/typo3-core-sa-2022-009) * [Vulnerability Report on huntr.dev](https://huntr.dev/bounties/51e9b709-193c-41fd-bd4a-833aaca0bd4e/) (embargoed +30 days)
10.4.32
Affected by 7 other vulnerabilities.
11.5.16
Affected by 7 other vulnerabilities.
VCID-w2qy-69nb-5ke5
Aliases:
GHSA-ppgf-8745-8pgx
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way, Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability. In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit has been identified so far.
8.7.17
Affected by 68 other vulnerabilities.
9.3.2
Affected by 84 other vulnerabilities.
VCID-whf8-jc59-uub6
Aliases:
CVE-2021-21357
GHSA-3vg7-jw9m-pc3f
Broken Access Control in Form Framework ### Problem Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. ### Solution Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. ### Credits Thanks to Richie Lee who reported this issue and to TYPO3 contributor Ralf Zimmermann who fixed the issue. ### References * [TYPO3-CORE-SA-2021-003](https://typo3.org/security/advisory/typo3-core-sa-2021-003)
8.7.40
Affected by 3 other vulnerabilities.
9.5.25
Affected by 12 other vulnerabilities.
10.4.14
Affected by 22 other vulnerabilities.
11.1.1
Affected by 23 other vulnerabilities.
VCID-x3t4-7hux-zya8
Aliases:
GHSA-v4qr-8h2v-qpjx
Cross-Site Scripting in TYPO3 CMS Backend Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
8.7.5
Affected by 77 other vulnerabilities.
VCID-xg9s-8fv2-87hq
Aliases:
GHSA-67wg-6j7r-mqh8
Arbitrary Code Execution in TYPO3 CMS Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload *.pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool. ``` \.(php[3-7]?|phpsh|phtml|pht)(\..*)?$|^\.htaccess$ ```
8.7.5
Affected by 77 other vulnerabilities.
VCID-xsd3-6zyc-j7dg
Aliases:
2018-12-11-4
Security Misconfiguration in Install Tool Cookie.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
VCID-xww9-ktn9-e3ga
Aliases:
CVE-2022-36105
GHSA-m392-235j-9r7r
TYPO3 CMS vulnerable to User Enumeration via Response Timing > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. ### Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. ### Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team members Oliver Hader who fixed the issue. ### References * [TYPO3-CORE-SA-2022-007](https://typo3.org/security/advisory/typo3-core-sa-2022-007) * [Vulnerability Report on huntr.dev](https://huntr.dev/bounties/7d519735-2877-4fad-bd77-accde3e290a7/) (embargoed +30 days)
10.4.32
Affected by 7 other vulnerabilities.
11.5.16
Affected by 7 other vulnerabilities.
VCID-y15u-f9e9-akff
Aliases:
2016-11-22-2
Path Traversal in TYPO3 Core.
8.4.1
Affected by 92 other vulnerabilities.
VCID-y74r-7jjs-nfbd
Aliases:
GHSA-mh3r-6cp5-hc2j
Authentication Bypass in TYPO3 Frontend Due to late TCA initialization the authentication service fails to restrict frontend user according to the validation rules. Therefore it is possible to authenticate restricted (e.g. disabled) frontend users.
8.6.1
Affected by 88 other vulnerabilities.
VCID-yt8r-5b7g-1ueq
Aliases:
GHSA-4h5c-5g25-v7fh
TYPO3 Cross-Site Scripting in Form Framework Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting.
8.7.23
Affected by 38 other vulnerabilities.
9.5.4
Affected by 56 other vulnerabilities.
VCID-yz56-gs5x-hudr
Aliases:
TYPO3-CORE-SA-2017-007
Arbitrary Code Execution Due to a missing file extension in the `fileDenyPattern`, backend user are allowed to upload *.pht files which can be executed in certain web server setups.
8.7.5
Affected by 77 other vulnerabilities.
VCID-zhvr-3e6u-2uc6
Aliases:
GHSA-hh95-5xm5-v8v7
TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey as secret - invalid or unsigned payload is not deserialized. However, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly known and unprotected backup files), there is the possibility that attackers know the private encryptionKey and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized. Requirements for successfully exploiting this vulnerability (all of the following): - rendering at least one Extbase plugin in the frontend - encryptionKey has been leaked (from LocalConfiguration.php or corresponding .env file)
8.7.30
Affected by 16 other vulnerabilities.
9.5.12
Affected by 27 other vulnerabilities.
VCID-zrvx-m37x-v3a1
Aliases:
2018-12-11-8
Cross-site Scripting Cross-Site Scripting in CKEditor.
8.7.21
Affected by 51 other vulnerabilities.
9.5.2
Affected by 69 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-07-03T19:07:39.222022+00:00 GitLab Importer Affected by VCID-56yk-z25r-nuap https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-g7hw-jh4p-75wr.yml 37.0.0
2025-07-03T19:07:38.804474+00:00 GitLab Importer Affected by VCID-7hee-5tpj-g7ct https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-f624-8hfq-5fh3.yml 37.0.0
2025-07-03T19:07:36.923876+00:00 GitLab Importer Affected by VCID-yt8r-5b7g-1ueq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-4h5c-5g25-v7fh.yml 37.0.0
2025-07-03T19:07:36.526007+00:00 GitLab Importer Affected by VCID-g8w9-nj7c-dfa4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-c5mj-39cf-3pp5.yml 37.0.0
2025-07-03T19:07:35.152906+00:00 GitLab Importer Affected by VCID-zhvr-3e6u-2uc6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-hh95-5xm5-v8v7.yml 37.0.0
2025-07-03T19:07:34.798835+00:00 GitLab Importer Affected by VCID-tvtv-cfzc-z3d5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-xgmx-j3hv-jh9x.yml 37.0.0
2025-07-03T19:07:34.114292+00:00 GitLab Importer Affected by VCID-mgtw-94ks-a7du https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-f777-f784-36gm.yml 37.0.0
2025-07-03T19:07:33.644784+00:00 GitLab Importer Affected by VCID-cxp1-whzb-p7hy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-v8m4-3w37-ghxx.yml 37.0.0
2025-07-03T19:07:33.273049+00:00 GitLab Importer Affected by VCID-hdsj-ya24-9uhk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-g585-crjf-vhwq.yml 37.0.0
2025-07-03T19:07:32.340313+00:00 GitLab Importer Affected by VCID-fhr8-f4h5-6ffx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-7q33-hxwj-7p8v.yml 37.0.0
2025-07-03T19:07:31.970991+00:00 GitLab Importer Affected by VCID-smyk-z453-gyag https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-772m-43f3-hmf8.yml 37.0.0
2025-07-03T19:07:30.822723+00:00 GitLab Importer Affected by VCID-mpuk-6hdb-sqh7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-6487-3qvg-8px9.yml 37.0.0
2025-07-03T19:07:27.406275+00:00 GitLab Importer Affected by VCID-3vjn-rrkb-nbbw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-8h4m-r4wm-xj7r.yml 37.0.0
2025-07-03T19:07:27.110459+00:00 GitLab Importer Affected by VCID-4zub-buj2-5kbh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-f3wf-q4fj-3gxf.yml 37.0.0
2025-07-03T19:07:26.589414+00:00 GitLab Importer Affected by VCID-4mfu-2wkc-ybbw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-8m6j-p5jv-v69w.yml 37.0.0
2025-07-03T19:07:25.839367+00:00 GitLab Importer Affected by VCID-ukvt-pj2t-9kcq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-2rcw-9hrm-8q7q.yml 37.0.0
2025-07-03T19:07:25.208893+00:00 GitLab Importer Affected by VCID-qj2p-m8ce-myb3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-85ch-44w7-rf32.yml 37.0.0
2025-07-03T19:07:07.658817+00:00 GitLab Importer Affected by VCID-bd6u-nca5-gyeu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-hq37-rfjc-mr8h.yml 37.0.0
2025-07-03T19:07:07.135041+00:00 GitLab Importer Affected by VCID-t352-87cy-4qhm https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-pw2q-qwvj-gh43.yml 37.0.0
2025-07-03T19:07:05.030804+00:00 GitLab Importer Affected by VCID-dm6k-fzm6-sqbe https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-p5c5-gmj4-g48f.yml 37.0.0
2025-07-03T19:07:04.286108+00:00 GitLab Importer Affected by VCID-d381-rcq3-n3az https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-vpr3-rc99-2wpr.yml 37.0.0
2025-07-03T19:07:03.985514+00:00 GitLab Importer Affected by VCID-cnqq-fdxb-9uat https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-c7rj-92xr-wprg.yml 37.0.0
2025-07-03T19:07:03.474602+00:00 GitLab Importer Affected by VCID-w2qy-69nb-5ke5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-ppgf-8745-8pgx.yml 37.0.0
2025-07-03T19:07:03.047367+00:00 GitLab Importer Affected by VCID-x3t4-7hux-zya8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-v4qr-8h2v-qpjx.yml 37.0.0
2025-07-03T19:07:02.495274+00:00 GitLab Importer Affected by VCID-snd3-qpkk-8bb5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-q9c4-9v5m-597p.yml 37.0.0
2025-07-03T19:07:01.344525+00:00 GitLab Importer Affected by VCID-2m7w-zfua-u7b9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-g4pf-3jvq-2gcw.yml 37.0.0
2025-07-03T19:07:00.727790+00:00 GitLab Importer Affected by VCID-u6ar-3wzb-u3eg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-g46h-v2cc-6c94.yml 37.0.0
2025-07-03T19:07:00.268938+00:00 GitLab Importer Affected by VCID-xg9s-8fv2-87hq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-67wg-6j7r-mqh8.yml 37.0.0
2025-07-03T19:07:00.021807+00:00 GitLab Importer Affected by VCID-y74r-7jjs-nfbd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-mh3r-6cp5-hc2j.yml 37.0.0
2025-07-03T19:06:59.477246+00:00 GitLab Importer Affected by VCID-8a25-9af4-tyhk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-xvcp-33rc-j8gq.yml 37.0.0
2025-07-03T19:06:59.059338+00:00 GitLab Importer Affected by VCID-bgk1-npak-uuhy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-qr5f-6fcv-w69q.yml 37.0.0
2025-07-03T19:06:58.785574+00:00 GitLab Importer Affected by VCID-brcm-16va-3yek https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-c7p6-3c9c-f88q.yml 37.0.0
2025-07-03T19:06:58.120963+00:00 GitLab Importer Affected by VCID-a6c5-ytdy-3qh4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-5gr6-97fv-52cc.yml 37.0.0
2025-07-03T19:06:57.416460+00:00 GitLab Importer Affected by VCID-mf9a-exme-b3ca https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-6f9m-v7mp-7jjq.yml 37.0.0
2025-07-03T19:06:57.054141+00:00 GitLab Importer Affected by VCID-24z2-dffm-wfdf https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-g9rv-6g56-65h8.yml 37.0.0
2025-07-03T19:06:56.875163+00:00 GitLab Importer Affected by VCID-tdsj-15xc-x3ar https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-qmwf-j7g7-f5jw.yml 37.0.0
2025-07-03T19:06:56.254533+00:00 GitLab Importer Affected by VCID-3wq5-qkuj-c7ce https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-hww5-6x85-mc24.yml 37.0.0
2025-07-03T19:06:56.060086+00:00 GitLab Importer Affected by VCID-axg7-qg5u-kbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-86r8-4g3w-7xjp.yml 37.0.0
2025-07-03T18:59:55.949881+00:00 GitLab Importer Affected by VCID-5m4k-jd3r-abaf https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-gj48-w74w-8gvm.yml 37.0.0
2025-07-03T18:59:53.827608+00:00 GitLab Importer Affected by VCID-5m4k-jd3r-abaf https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GMS-2024-342.yml 37.0.0
2025-07-03T18:36:15.298811+00:00 GitLab Importer Affected by VCID-u8we-bkyu-83b8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-23503.yml 37.0.0
2025-07-03T18:36:13.766436+00:00 GitLab Importer Affected by VCID-kh9n-kuvd-pbat https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-23501.yml 37.0.0
2025-07-03T18:30:22.119938+00:00 GitLab Importer Affected by VCID-w2hv-ftte-fyd1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-36107.yml 37.0.0
2025-07-03T18:30:20.160776+00:00 GitLab Importer Affected by VCID-xww9-ktn9-e3ga https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-36105.yml 37.0.0
2025-07-03T18:25:47.347693+00:00 GitLab Importer Affected by VCID-q2ch-qd6x-vqeu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2022-31047.yml 37.0.0
2025-07-03T18:13:53.576971+00:00 GitLab Importer Affected by VCID-3c1n-du49-6bes https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2016-5385.yml 37.0.0
2025-07-03T18:02:44.404433+00:00 GitLab Importer Affected by VCID-tvq8-qbwc-qkfs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-32768.yml 37.0.0
2025-07-03T18:02:20.923018+00:00 GitLab Importer Affected by VCID-ks2k-ehk8-nqbm https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-32669.yml 37.0.0
2025-07-03T18:02:20.537431+00:00 GitLab Importer Affected by VCID-7vrs-6mah-2fh9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-32668.yml 37.0.0
2025-07-03T18:02:18.378948+00:00 GitLab Importer Affected by VCID-rmnv-emnu-6bfy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-32767.yml 37.0.0
2025-07-03T17:56:43.406678+00:00 GitLab Importer Affected by VCID-d42j-347n-e7en https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21338.yml 37.0.0
2025-07-03T17:56:37.150713+00:00 GitLab Importer Affected by VCID-whf8-jc59-uub6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21357.yml 37.0.0
2025-07-03T17:56:28.279636+00:00 GitLab Importer Affected by VCID-ekj9-nhu4-93cc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21370.yml 37.0.0
2025-07-03T17:56:26.575906+00:00 GitLab Importer Affected by VCID-v83x-2hx7-yycg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21339.yml 37.0.0
2025-07-03T17:56:23.793939+00:00 GitLab Importer Affected by VCID-fbhh-atu7-e3da https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2021-21355.yml 37.0.0
2025-07-03T17:37:57.511658+00:00 GitLab Importer Affected by VCID-8mc9-ye3u-c3aj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2019-19849.yml 37.0.0
2025-07-03T17:37:56.035682+00:00 GitLab Importer Affected by VCID-hg6g-kn76-bfbh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2019-19848.yml 37.0.0
2025-07-03T17:37:55.236193+00:00 GitLab Importer Affected by VCID-rk6h-431z-ubbk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2019-19850.yml 37.0.0
2025-07-03T17:35:08.791565+00:00 GitLab Importer Affected by VCID-aj9w-bguk-9yek https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-06-25-5.yml 37.0.0
2025-07-03T17:35:07.658147+00:00 GitLab Importer Affected by VCID-t7b2-114h-ekaw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-06-25-2.yml 37.0.0
2025-07-03T17:35:07.404349+00:00 GitLab Importer Affected by VCID-bvjs-f141-sfc7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-06-25-1.yml 37.0.0
2025-07-03T17:35:06.339231+00:00 GitLab Importer Affected by VCID-u3es-5tz4-ybfc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-06-25-3.yml 37.0.0
2025-07-03T17:35:06.070789+00:00 GitLab Importer Affected by VCID-tbp9-2rg8-u7bk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-06-25-4.yml 37.0.0
2025-07-03T17:33:58.421661+00:00 GitLab Importer Affected by VCID-f9e5-am8t-j7gc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2019-11832.yml 37.0.0
2025-07-03T17:33:57.943693+00:00 GitLab Importer Affected by VCID-rep9-2rxn-gfee https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-05-07-3.yml 37.0.0
2025-07-03T17:33:57.696421+00:00 GitLab Importer Affected by VCID-dkmy-bwds-s7f4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-05-07-1.yml 37.0.0
2025-07-03T17:33:56.853935+00:00 GitLab Importer Affected by VCID-7zyp-yza7-2udn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-05-07-2.yml 37.0.0
2025-07-03T17:31:23.091744+00:00 GitLab Importer Affected by VCID-dfng-qmn8-jyc5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-01-22-2.yml 37.0.0
2025-07-03T17:31:22.196535+00:00 GitLab Importer Affected by VCID-r9yp-177t-efc4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-01-22-7.yml 37.0.0
2025-07-03T17:31:21.517200+00:00 GitLab Importer Affected by VCID-tfey-6228-tybz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-01-22-5.yml 37.0.0
2025-07-03T17:31:21.098146+00:00 GitLab Importer Affected by VCID-17h4-rww9-93ad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-01-22-3.yml 37.0.0
2025-07-03T17:31:20.856185+00:00 GitLab Importer Affected by VCID-pe6b-ygxy-kqes https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-01-22-4.yml 37.0.0
2025-07-03T17:31:19.798519+00:00 GitLab Importer Affected by VCID-e3gy-22s1-huhc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-01-22-1.yml 37.0.0
2025-07-03T17:31:19.155077+00:00 GitLab Importer Affected by VCID-8u66-mv4d-zbd4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2019-01-22-6.yml 37.0.0
2025-07-03T17:30:48.109303+00:00 GitLab Importer Affected by VCID-xsd3-6zyc-j7dg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-4.yml 37.0.0
2025-07-03T17:30:47.798380+00:00 GitLab Importer Affected by VCID-7yn7-f2cw-ukfj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-6.yml 37.0.0
2025-07-03T17:30:46.837887+00:00 GitLab Importer Affected by VCID-8re4-c6j8-hyfh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-7.yml 37.0.0
2025-07-03T17:30:46.141898+00:00 GitLab Importer Affected by VCID-53bg-1gfq-7bap https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-2.yml 37.0.0
2025-07-03T17:30:45.654188+00:00 GitLab Importer Affected by VCID-fj4s-fcy4-2fcj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-1.yml 37.0.0
2025-07-03T17:30:45.357385+00:00 GitLab Importer Affected by VCID-hrjb-bbbx-1kbq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-5.yml 37.0.0
2025-07-03T17:30:44.587485+00:00 GitLab Importer Affected by VCID-1txn-xjt1-37ha https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-3.yml 37.0.0
2025-07-03T17:30:44.148792+00:00 GitLab Importer Affected by VCID-zrvx-m37x-v3a1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-12-11-8.yml 37.0.0
2025-07-03T17:30:39.702512+00:00 GitLab Importer Affected by VCID-pwe8-razn-buae https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2018-17960.yml 37.0.0
2025-07-03T17:28:54.145938+00:00 GitLab Importer Affected by VCID-u34g-yks8-hbay https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2018-14041.yml 37.0.0
2025-07-03T17:27:56.054398+00:00 GitLab Importer Affected by VCID-cvpr-b5np-6bcv https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-07-12-1.yml 37.0.0
2025-07-03T17:27:54.361960+00:00 GitLab Importer Affected by VCID-n7ha-dtwq-xqf9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2018-07-12-2.yml 37.0.0
2025-07-03T17:23:52.098626+00:00 GitLab Importer Affected by VCID-jtuy-ex79-tfbu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2018-6905.yml 37.0.0
2025-07-03T17:20:14.288027+00:00 GitLab Importer Affected by VCID-1d1x-7vx6-zbfw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2017-14251.yml 37.0.0
2025-07-03T17:20:08.080952+00:00 GitLab Importer Affected by VCID-58sc-bkhd-7ud1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-09-05-4.yml 37.0.0
2025-07-03T17:20:07.864559+00:00 GitLab Importer Affected by VCID-scue-m12x-nkf4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-09-05-3.yml 37.0.0
2025-07-03T17:20:07.550498+00:00 GitLab Importer Affected by VCID-vftm-uyy7-63fb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-09-05-2.yml 37.0.0
2025-07-03T17:20:07.320950+00:00 GitLab Importer Affected by VCID-vyhd-x5fe-b3aj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2017-005.yml 37.0.0
2025-07-03T17:20:07.100182+00:00 GitLab Importer Affected by VCID-ct1e-wck2-6qbj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-09-05-1.yml 37.0.0
2025-07-03T17:20:06.923015+00:00 GitLab Importer Affected by VCID-fru4-hjhx-47ev https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2017-006.yml 37.0.0
2025-07-03T17:20:06.698322+00:00 GitLab Importer Affected by VCID-yz56-gs5x-hudr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2017-007.yml 37.0.0
2025-07-03T17:20:06.406683+00:00 GitLab Importer Affected by VCID-2x7t-5tdv-cuge https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2017-004.yml 37.0.0
2025-07-03T17:18:30.540772+00:00 GitLab Importer Affected by VCID-hwcz-r4cu-9fba https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2017-003.yml 37.0.0
2025-07-03T17:18:30.333887+00:00 GitLab Importer Affected by VCID-uzut-7219-xkc1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2017-002.yml 37.0.0
2025-07-03T17:18:29.894222+00:00 GitLab Importer Affected by VCID-7yrw-wj9m-hkd4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-02-28-2.yml 37.0.0
2025-07-03T17:18:29.681102+00:00 GitLab Importer Affected by VCID-2pbg-f35b-jyaa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-02-28-1.yml 37.0.0
2025-07-03T17:18:15.288214+00:00 GitLab Importer Affected by VCID-htsn-wq8h-qbgp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-01-03-1.yml 37.0.0
2025-07-03T17:16:33.348355+00:00 GitLab Importer Affected by VCID-heyp-4b45-v7gp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-11-22-1.yml 37.0.0
2025-07-03T17:16:33.049125+00:00 GitLab Importer Affected by VCID-y15u-f9e9-akff https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-11-22-2.yml 37.0.0
2025-07-03T17:16:32.746138+00:00 GitLab Importer Affected by VCID-8fkz-6kqu-gqbk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2016-024.yml 37.0.0
2025-07-03T17:16:32.457528+00:00 GitLab Importer Affected by VCID-e5ns-2x1v-sbaj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2016-023.yml 37.0.0
2025-07-03T17:16:17.927713+00:00 GitLab Importer Affected by VCID-f6sb-d831-u3fh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2016-021.yml 37.0.0
2025-07-03T17:16:17.644350+00:00 GitLab Importer Affected by VCID-ky6n-ka2n-ayhu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/TYPO3-CORE-SA-2016-022.yml 37.0.0
2025-07-03T17:16:02.445515+00:00 GitLab Importer Affected by VCID-ungm-t9nm-hyf8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-07-19-6.yml 37.0.0
2025-07-03T17:16:02.288448+00:00 GitLab Importer Affected by VCID-6bne-vnc6-wfe9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-07-19-5.yml 37.0.0
2025-07-03T17:16:02.014849+00:00 GitLab Importer Affected by VCID-d2qd-qjn9-jffs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-07-19-1.yml 37.0.0
2025-07-03T17:16:01.757213+00:00 GitLab Importer Affected by VCID-dc9k-gxr2-6bah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-07-19-7.yml 37.0.0
2025-07-03T17:16:01.336246+00:00 GitLab Importer Affected by VCID-psu6-y6fc-nqh4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-07-19-2.yml 37.0.0
2025-07-03T17:16:01.092152+00:00 GitLab Importer Affected by VCID-cdkv-3rbf-27ed https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-07-19-4.yml 37.0.0
2025-07-03T17:15:58.905142+00:00 GitLab Importer Affected by VCID-gb7f-4sm6-tkaw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-09-14-2.yml 37.0.0
2025-07-03T17:15:58.659114+00:00 GitLab Importer Affected by VCID-t7fe-ph2m-j3e5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2016-09-14-1.yml 37.0.0
2025-07-03T16:43:17.827017+00:00 GHSA Importer Affected by VCID-pwe8-razn-buae https://github.com/advisories/GHSA-g68x-vvqq-pvw3 37.0.0
2025-07-03T13:56:51.810095+00:00 GitLab Importer Affected by VCID-y74r-7jjs-nfbd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/GHSA-mh3r-6cp5-hc2j.yml 36.1.3
2025-07-01T18:10:30.741120+00:00 GitLab Importer Affected by VCID-1d1x-7vx6-zbfw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2017-14251.yml 36.1.3
2025-07-01T18:10:21.518826+00:00 GitLab Importer Affected by VCID-2pbg-f35b-jyaa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/2017-02-28-1.yml 36.1.3
2025-07-01T14:35:06.139093+00:00 GHSA Importer Affected by VCID-y74r-7jjs-nfbd https://github.com/advisories/GHSA-mh3r-6cp5-hc2j 36.1.3