VulnerableCode Package Details - pkg:composer/typo3/cms@10.4.16

Vulnerabilities affecting this package (37)

Advisory	Summary	Fixed in package version
GHSA-8mq9-fqv8-59wf Aliases: CVE-2021-32667	Cross-Site Scripting in Page Preview > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.0) ### Problem Failing to properly encode _Page …	10.4.18 Vulnerable
GHSA-rgcg-28xm-8mmw Aliases: CVE-2021-32669	Cross-Site Scripting in Backend Grid View ### Problem Failing to properly encode settings for _backend layouts_, the corresponding grid view …	10.4.18 Vulnerable
GHSA-34fr-fhqr-7235 Aliases: CVE-2021-32767	Information Disclosure in User Authentication > ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that …	10.4.18 Vulnerable
GHSA-6mh3-j5r5-2379 Aliases: CVE-2021-32668	Cross-Site Scripting in Query Generator & Query View > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5) ### Problem Failing to …	10.4.18 Vulnerable
GHSA-c5c9-8c6m-727v Aliases: CVE-2021-32768	Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize …	10.4.19 Vulnerable
GHSA-hvwx-qh2h-xcfj Aliases: CVE-2022-23499	TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting ### Problem Due to a parsing issue in the upstream package [`masterminds/html5`](https://packagist.org/packages/masterminds/html5), malicious …	10.4.33 Vulnerable
GHSA-mgj2-q8wp-29rr Aliases: CVE-2022-23502	TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset ### Problem When users reset their password using the corresponding …	10.4.33 Vulnerable
GHSA-8c28-5mp7-v24h Aliases: CVE-2022-23500	TYPO3 CMS vulnerable to Denial of Service in Page Error Handling ### Problem Requesting invalid or non-existing resources via HTTP …	10.4.33 Vulnerable
GHSA-8w3p-qh3x-6gjr Aliases: CVE-2022-23504	TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration > ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.3) ### …	10.4.33 Vulnerable
GHSA-jfp7-79g7-89rf Aliases: CVE-2022-23501	TYPO3 CMS vulnerable to Weak Authentication in Frontend Login ### Problem Restricting frontend login to specific users, organized in different …	10.4.33 Vulnerable
GHSA-c5wx-6c2c-f7rm Aliases: CVE-2022-23503	TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework ### Problem Due to the lack of separating user-submitted data …	10.4.33 Vulnerable
GHSA-wwjw-r3gj-39fq Aliases: CVE-2022-31050	Insufficient Session Expiration in TYPO3's Admin Tool > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.6) ### Problem Admin Tool sessions …	10.4.29 Vulnerable
GHSA-h4mx-xv96-2jgm Aliases: CVE-2022-31049	Cross-Site Scripting in TYPO3's Frontend Login Mailer > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9) ### Problem User submitted content …	10.4.29 Vulnerable
GHSA-8gmv-9hwg-w89g Aliases: CVE-2022-31046	Information Disclosure via Export Module > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.0) ### Problem The export functionality fails to …	10.4.29 Vulnerable
GHSA-3r95-23jp-mhvg Aliases: CVE-2022-31048	Cross-Site Scripting in TYPO3's Form Framework > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered …	10.4.29 Vulnerable
GHSA-fh99-4pgr-8j99 Aliases: CVE-2022-31047	Insertion of Sensitive Information into Log File in typo3/cms-core > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It …	10.4.29 Vulnerable
GHSA-m392-235j-9r7r Aliases: CVE-2022-36105	TYPO3 CMS vulnerable to User Enumeration via Response Timing > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It …	10.4.32 Vulnerable
GHSA-5959-4x58-r8c2 Aliases: CVE-2022-36106	TYPO3 CMS missing check for expiration time of password reset token for backend users > ### Meta > * CVSS: …	10.4.32 Vulnerable
GHSA-47m6-46mj-p235 Aliases: CVE-2022-36020	TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) ### Problem Due to a …	10.4.32 Vulnerable
GHSA-9c6w-55cp-5w25 Aliases: CVE-2022-36107	TYPO3 CMS Stored Cross-Site Scripting via FileDumpController > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0) ### Problem It has been …	10.4.32 Vulnerable
GHSA-fv2m-9249-qx85 Aliases: CVE-2022-36108	TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.1) ### Problem …	10.4.32 Vulnerable
GHSA-r4f8-f93x-5qh3 Aliases: CVE-2023-24814	TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering > ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C` (8.2) ### Problem TYPO3 core component `GeneralUtility::getIndpEnv()` …	10.4.35 Vulnerable
CVE-2021-32767 Aliases: GHSA-34fr-fhqr-7235	Inclusion of Sensitive Information in Log Files TYPO3 is an open source PHP based web content management system. User credentials …	10.4.18 Vulnerable 11.3.1 Vulnerable 9.5.28 Vulnerable
CVE-2021-32768 Aliases: GHSA-c5c9-8c6m-727v	Cross-site Scripting TYPO3 is an open source PHP based web content management system released under the GNU GPL. sanitize and …	10.4.19 Vulnerable 11.3.2 Vulnerable 9.5.29 Vulnerable
CVE-2021-32667 Aliases: GHSA-8mq9-fqv8-59wf	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When `_Page` `TSconfig_` settings are not properly encoded, corresponding page preview module …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2021-32669 Aliases: GHSA-rgcg-28xm-8mmw	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When settings for `_backend layouts_` are not properly encoded, the corresponding grid …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2021-32668 Aliases: GHSA-6mh3-j5r5-2379	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When error messages are not properly encoded, the components `_QueryGenerator_` and `_QueryView_` …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2022-23501 Aliases: GHSA-jfp7-79g7-89rf	TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-36108 Aliases: GHSA-fv2m-9249-qx85	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
CVE-2022-36107 Aliases: GHSA-9c6w-55cp-5w25	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
CVE-2022-23503 Aliases: GHSA-c5wx-6c2c-f7rm	Improper Control of Generation of Code ('Code Injection') TYPO3 is an open source PHP based web content management system. Versions …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-36106 Aliases: GHSA-5959-4x58-r8c2	Improper Authentication TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
CVE-2022-23500 Aliases: GHSA-8c28-5mp7-v24h	Uncontrolled Recursion TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, …	10.4.33 Vulnerable 11.5.20 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable
CVE-2022-31047 Aliases: GHSA-fh99-4pgr-8j99	Insertion of Sensitive Information into Log File TYPO3 is an open source web content management system. Prior to versions 7.6.57 …	10.4.29 Vulnerable 11.5.11 Vulnerable 10.4.29 Vulnerable 11.5.11 Vulnerable
CVE-2023-24814 Aliases: GHSA-r4f8-f93x-5qh3	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is a free and open source Content Management Framework …	11.5.23 Vulnerable 12.2.0 Vulnerable 10.4.36 Vulnerable 11.5.23 Vulnerable 12.2.0 Vulnerable 10.4.36 Vulnerable
CVE-2022-36105 Aliases: GHSA-m392-235j-9r7r	Observable Discrepancy TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
GHSA-jg55-3q6h-2ccf Aliases: CVE-2009-0816	Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.0