Search for packages
| purl | pkg:composer/typo3/cms@8.7.27 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-3wq5-qkuj-c7ce | Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings. A valid backend user account having access to modify values for fields pages.TSconfig and pages.tsconfig_includes is needed in order to exploit this vulnerability. |
GHSA-hww5-6x85-mc24
|
| VCID-87g8-zcww-p7bm | Typo3 Cross-Site Scripting in Link Handling TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. |
CVE-2019-12748
GHSA-r6fv-56gp-j3r4 |
| VCID-aj9w-bguk-9yek | Insecure Deserialization in TYPO3 CMS. |
2019-06-25-5
|
| VCID-bgk1-npak-uuhy | Typo3 Security Misconfiguration in Frontend Session Handling It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data. |
GHSA-qr5f-6fcv-w69q
|
| VCID-bvjs-f141-sfc7 | Information Disclosure in Backend User Interface. |
2019-06-25-1
|
| VCID-snd3-qpkk-8bb5 | Typo3 Information Disclosure in Backend User Interface The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability. |
GHSA-q9c4-9v5m-597p
|
| VCID-t7b2-114h-ekaw | Cross-site Scripting Cross-Site Scripting in Link Handling. |
2019-06-25-2
|
| VCID-tbp9-2rg8-u7bk | Code Injection Arbitrary Code Execution and Cross-Site Scripting in Backend API. |
2019-06-25-4
|
| VCID-thjz-e86b-n3a7 | Typo3 Vulnerable to Insecure Deserialization TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. |
CVE-2019-12747
GHSA-86hp-xrhj-fhpq |
| VCID-u3es-5tz4-ybfc | Security Misconfiguration in Frontend Session Handling. |
2019-06-25-3
|