Search for packages
| purl | pkg:composer/typo3/cms@10.2.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8mq9-fqv8-59wf
Aliases: CVE-2021-32667 |
Cross-Site Scripting in Page Preview > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.0) ### Problem Failing to properly encode _Page … |
Vulnerable |
|
GHSA-rgcg-28xm-8mmw
Aliases: CVE-2021-32669 |
Cross-Site Scripting in Backend Grid View ### Problem Failing to properly encode settings for _backend layouts_, the corresponding grid view … |
Vulnerable |
|
GHSA-34fr-fhqr-7235
Aliases: CVE-2021-32767 |
Information Disclosure in User Authentication > ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that … |
Vulnerable |
|
GHSA-6mh3-j5r5-2379
Aliases: CVE-2021-32668 |
Cross-Site Scripting in Query Generator & Query View > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5) ### Problem Failing to … |
Vulnerable |
|
GHSA-c5c9-8c6m-727v
Aliases: CVE-2021-32768 |
Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize … |
Vulnerable |
|
GHSA-4p9g-qgx9-397p
Aliases: CVE-2021-21359 |
Denial of Service in Page Error Handling > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C` (5.5) > * CWE-405, CWE-674 > … |
Vulnerable |
|
GHSA-hvwx-qh2h-xcfj
Aliases: CVE-2022-23499 |
TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting ### Problem Due to a parsing issue in the upstream package [`masterminds/html5`](https://packagist.org/packages/masterminds/html5), malicious … |
Vulnerable |
|
GHSA-mgj2-q8wp-29rr
Aliases: CVE-2022-23502 |
TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset ### Problem When users reset their password using the corresponding … |
Vulnerable |
|
GHSA-8c28-5mp7-v24h
Aliases: CVE-2022-23500 |
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling ### Problem Requesting invalid or non-existing resources via HTTP … |
Vulnerable |
|
GHSA-8w3p-qh3x-6gjr
Aliases: CVE-2022-23504 |
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration > ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.3) ### … |
Vulnerable |
|
GHSA-jfp7-79g7-89rf
Aliases: CVE-2022-23501 |
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login ### Problem Restricting frontend login to specific users, organized in different … |
Vulnerable |
|
GHSA-c5wx-6c2c-f7rm
Aliases: CVE-2022-23503 |
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework ### Problem Due to the lack of separating user-submitted data … |
Vulnerable |
|
GHSA-wwjw-r3gj-39fq
Aliases: CVE-2022-31050 |
Insufficient Session Expiration in TYPO3's Admin Tool > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.6) ### Problem Admin Tool sessions … |
Vulnerable |
|
GHSA-h4mx-xv96-2jgm
Aliases: CVE-2022-31049 |
Cross-Site Scripting in TYPO3's Frontend Login Mailer > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9) ### Problem User submitted content … |
Vulnerable |
|
GHSA-8gmv-9hwg-w89g
Aliases: CVE-2022-31046 |
Information Disclosure via Export Module > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.0) ### Problem The export functionality fails to … |
Vulnerable |
|
GHSA-3r95-23jp-mhvg
Aliases: CVE-2022-31048 |
Cross-Site Scripting in TYPO3's Form Framework > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered … |
Vulnerable |
|
GHSA-fh99-4pgr-8j99
Aliases: CVE-2022-31047 |
Insertion of Sensitive Information into Log File in typo3/cms-core > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It … |
Vulnerable |
|
GHSA-m392-235j-9r7r
Aliases: CVE-2022-36105 |
TYPO3 CMS vulnerable to User Enumeration via Response Timing > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It … |
Vulnerable |
|
GHSA-47m6-46mj-p235
Aliases: CVE-2022-36020 |
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) ### Problem Due to a … |
Vulnerable |
|
GHSA-9c6w-55cp-5w25
Aliases: CVE-2022-36107 |
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0) ### Problem It has been … |
Vulnerable |
|
GHSA-r4f8-f93x-5qh3
Aliases: CVE-2023-24814 |
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering > ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C` (8.2) ### Problem TYPO3 core component `GeneralUtility::getIndpEnv()` … |
Vulnerable |
|
GHSA-q9cp-mc96-m4w2
Aliases: CVE-2020-26229 |
XML External Entity in Dashboard Widget ### Problem It has been discovered that RSS widgets are susceptible to XML external … |
Vulnerable |
|
GHSA-954j-f27r-cj52
Aliases: CVE-2020-26228 |
Cleartext storage of session identifier User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. … |
Vulnerable |
|
GHSA-vqqx-jw6p-q3rf
Aliases: CVE-2020-26227 |
Cross-Site Scripting in Fluid view helpers > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) > * CWE-79 ### Problem It … |
Vulnerable |
|
GHSA-2rxh-h6h9-qrqc
Aliases: CVE-2020-11066 |
Class destructors causing side-effects when being unserialized in TYPO3 CMS Calling unserialize() on malicious user-submitted content can result in the … |
Vulnerable |
|
GHSA-pqg8-crx9-g8m4
Aliases: CVE-2020-11069 |
Backend Same-Site Request Forgery in TYPO3 CMS > ### Meta > * CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C > * CWE-352 > * … |
Vulnerable |
|
GHSA-347x-877p-hcwx
Aliases: CVE-2020-11063 |
Information Disclosure in Password Reset In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be … |
Vulnerable |
|
GHSA-4j77-gg36-9864
Aliases: CVE-2020-11065 |
Cross-Site Scripting in TYPO3 CMS Link Handling It has been discovered that link tags generated by `typolink` functionality are vulnerable … |
Vulnerable |
|
GHSA-43gj-mj2w-wh46
Aliases: CVE-2020-11064 |
Cross-Site Scripting in TYPO3 CMS Form Engine In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 … |
Vulnerable |
|
GHSA-2wj9-434x-9hvp
Aliases: CVE-2020-11067 |
Insecure Deserialization in Backend User Settings in TYPO3 CMS It has been discovered that backend user settings (in $BE_USER->uc) are … |
Vulnerable |
|
GHSA-m5vr-3m74-jwxp
Aliases: CVE-2020-15098 |
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2) … |
Vulnerable |
|
GHSA-3x94-fv5h-5q2c
Aliases: CVE-2020-15099 |
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5) > … |
Vulnerable |
|
CVE-2021-32767
Aliases: GHSA-34fr-fhqr-7235 |
Inclusion of Sensitive Information in Log Files TYPO3 is an open source PHP based web content management system. User credentials … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21357
Aliases: GHSA-3vg7-jw9m-pc3f |
Path Traversal Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-19849
|
Deserialization of Untrusted Data It has been discovered that the classes `QueryGenerator` and `QueryView` are vulnerable to insecure deserialization. One … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-32768
Aliases: GHSA-c5c9-8c6m-727v |
Cross-site Scripting TYPO3 is an open source PHP based web content management system released under the GNU GPL. sanitize and … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21358
Aliases: GHSA-x79j-wgqv-g8h2 |
Cross-site Scripting The Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user … |
Vulnerable Vulnerable |
|
CVE-2021-32667
Aliases: GHSA-8mq9-fqv8-59wf |
Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When `_Page` `TSconfig_` settings are not properly encoded, corresponding page preview module … |
Vulnerable Vulnerable |
|
CVE-2021-32669
Aliases: GHSA-rgcg-28xm-8mmw |
Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When settings for `_backend layouts_` are not properly encoded, the corresponding grid … |
Vulnerable Vulnerable |
|
CVE-2021-21338
Aliases: GHSA-4jhw-2p6j-5wmp |
URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-26227
Aliases: GHSA-vqqx-jw6p-q3rf |
Cross-site Scripting TYPO3 is an open source PHP based web content management system. In TYPO3 the system extension Fluid (typo3/cms-fluid) … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-32668
Aliases: GHSA-6mh3-j5r5-2379 |
Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When error messages are not properly encoded, the components `_QueryGenerator_` and `_QueryView_` … |
Vulnerable Vulnerable |
|
CVE-2021-21370
Aliases: GHSA-x7hc-x7fm-f7qh |
Cross-site Scripting Content elements of type `_menu_` are vulnerable to cross-site scripting when their referenced items get previewed in the … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-11065
Aliases: GHSA-4j77-gg36-9864 |
Cross-site Scripting It has been discovered that link tags generated by the typolink functionality are vulnerable to cross-site scripting; properties … |
Vulnerable Vulnerable |
|
CVE-2020-26228
Aliases: GHSA-954j-f27r-cj52 |
Cleartext Storage of Sensitive Information TYPO3 is an open source PHP based web content management system. In TYPO3 user session … |
Vulnerable Vulnerable |
|
CVE-2019-19848
|
Path Traversal It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21339
Aliases: GHSA-qx3w-4864-94ch |
Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21355
Aliases: GHSA-2r6j-862c-m2v2 |
Unrestricted Upload of File with Dangerous Type Due to the lack of ensuring file extensions belong to configured allowed mime-types, … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-59pj-7mjh-4465
Aliases: CVE-2019-19850 |
TYPO3 SQL Injection in low-level Query Generator An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x … |
Vulnerable Vulnerable |
|
GHSA-77p4-wfr8-977w
Aliases: CVE-2019-19848 |
TYPO3 Directory Traversal on ZIP extraction An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before … |
Vulnerable Vulnerable |
|
CVE-2022-23501
Aliases: GHSA-jfp7-79g7-89rf |
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-36108
Aliases: GHSA-fv2m-9249-qx85 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-36107
Aliases: GHSA-9c6w-55cp-5w25 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-23503
Aliases: GHSA-c5wx-6c2c-f7rm |
Improper Control of Generation of Code ('Code Injection') TYPO3 is an open source PHP based web content management system. Versions … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-36106
Aliases: GHSA-5959-4x58-r8c2 |
Improper Authentication TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-23500
Aliases: GHSA-8c28-5mp7-v24h |
Uncontrolled Recursion TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-31047
Aliases: GHSA-fh99-4pgr-8j99 |
Insertion of Sensitive Information into Log File TYPO3 is an open source web content management system. Prior to versions 7.6.57 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-24814
Aliases: GHSA-r4f8-f93x-5qh3 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is a free and open source Content Management Framework … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-36105
Aliases: GHSA-m392-235j-9r7r |
Observable Discrepancy TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-4jhw-2p6j-5wmp
Aliases: CVE-2021-21338 |
Open Redirection in Login Handling ### Problem It has been discovered that Login Handling is susceptible to open redirection which … |
Vulnerable Vulnerable |
|
GHSA-fjh3-g8gq-9q92
Aliases: CVE-2021-21340 |
Cross-Site Scripting in Content Preview ### Problem It has been discovered that database fields used as _descriptionColumn_ are vulnerable to … |
Vulnerable Vulnerable |
|
GHSA-3vg7-jw9m-pc3f
Aliases: CVE-2021-21357 |
Broken Access Control in Form Framework ### Problem Due to improper input validation, attackers can by-pass restrictions of predefined options … |
Vulnerable Vulnerable |
|
GHSA-qx3w-4864-94ch
Aliases: CVE-2021-21339 |
Cleartext storage of session identifier ### Problem User session identifiers were stored in cleartext - without processing of additional cryptographic … |
Vulnerable Vulnerable |
|
GHSA-x7hc-x7fm-f7qh
Aliases: CVE-2021-21370 |
Cross-Site Scripting in Content Preview (CType menu) ### Problem It has been discovered that content elements of type _menu_ are … |
Vulnerable Vulnerable |
|
GHSA-x79j-wgqv-g8h2
Aliases: CVE-2021-21358 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form ### Problem It has been discovered that the … |
Vulnerable Vulnerable |
|
GHSA-2r6j-862c-m2v2
Aliases: CVE-2021-21355 |
Unrestricted File Upload in Form Framework ### Problem Due to the lack of ensuring file extensions belong to configured allowed … |
Vulnerable Vulnerable |
|
GHSA-jg55-3q6h-2ccf
Aliases: CVE-2009-0816 |
Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-g7hw-jh4p-75wr
|
TYPO3 Cross-Site Scripting in Filelist Module It has been discovered that the output table listing in the “Files” backend module … | |
|
GHSA-v8m4-3w37-ghxx
|
TYPO3 Cross-Site Scripting in Form Framework validation handling It has been discovered that the output of field validation errors in … | |
|
GHSA-xgmx-j3hv-jh9x
|
TYPO3 Cross-Site Scripting in Link Handling It has been discovered that `t3://` URL handling and typolink functionality are vulnerable to … | |
|
GHSA-rcgc-4xfc-564v
|
TYPO3 Insecure Deserialization in Query Generator & Query View An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, … |
CVE-2019-19849
|