VulnerableCode Package Details - pkg:composer/typo3/cms@6.2.11

Vulnerabilities affecting this package (99)

Advisory	Summary	Fixed in package version
GHSA-989h-wv8x-933p Aliases: CVE-2015-5956	TYPO3 cross-site scripting (XSS) The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote …	6.2.15 Vulnerable
GHSA-j6c3-3c4w-qv8p Aliases: CVE-2013-7341	Moodle cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through …	6.2.14 Vulnerable
GHSA-gj48-w74w-8gvm	Path Traversal in TYPO3 Core Due to a too loose type check in an API method, attackers could bypass the …	6.2.29 Vulnerable
GHSA-wh8q-72cp-p5wf	Cross-Site Scripting in TYPO3 component Indexed Search Failing to properly encode editor input, the search result view of indexed_search is …	6.2.16 Vulnerable
GHSA-qffc-gwpp-m2xr	XML External Entity (XXE) Processing in TYPO3 Core All XML processing within the TYPO3 CMS are vulnerable to XEE processing. …	6.2.19 Vulnerable
GHSA-9895-53fc-98v2	TYPO3 SQL Injection in dbal A flaw in the database escaping API results in a SQL injection vulnerability when extension …	6.2.18 Vulnerable
GHSA-pmxp-7224-h794	Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search Due to an oversized maximum result limit, TYPO3 component …	6.2.19 Vulnerable
GHSA-gwfx-p7mr-f92v	Missing Access Check in TYPO3 CMS Extbase request handling fails to implement a proper access check for requested controller/ action …	6.2.25 Vulnerable
GHSA-qrxh-46mr-pr7q	TYPO3 is susceptible to Cross-Site Flashing The flashplayer misses to validate flash and image files. Therefore it is possible to …	6.2.16 Vulnerable
GHSA-wrpf-2x8h-82gr	Typo3 Arbitrary File Disclosure in Form Component Failing to properly validate user input, the form component is susceptible to Arbitrary …	6.2.20 Vulnerable
GHSA-c7rj-92xr-wprg	Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To …	6.2.29 Vulnerable
GHSA-6fc6-cj2j-h22x	TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend Failing to properly encode editor input, several frontend components are susceptible to Cross-Site …	6.2.16 Vulnerable
GHSA-vgm8-r9gm-fw59	TYPO3 Cross-Site Scripting in legacy form component Failing to sanitize content from editors, the legacy form component is susceptible to …	6.2.18 Vulnerable
GHSA-5cxf-xx9j-54jc	Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend Failing to properly encode user input, several backend components are susceptible to Cross-Site …	6.2.16 Vulnerable
GHSA-3jxq-5xhh-9jr3	Cross-Site Scripting (XSS) in TYPO3 component Backend Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site …	6.2.19 Vulnerable
GHSA-g4pf-3jvq-2gcw	TYPO3 Remote Code Execution in third party library swiftmailer TYPO3 uses the package swiftmailer/swiftmailer for mail actions. This package is …	6.2.30 Vulnerable
GHSA-5j86-5xvg-7q93	TYPO3 Cross-Site Scripting (XSS) in form component Failing to sanitize content from unauthenticated website visitors, the form component is susceptible …	6.2.18 Vulnerable
GHSA-p5c5-gmj4-g48f	Cross-Site Scripting (XSS) vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized …	6.2.26 Vulnerable
GHSA-pw2q-qwvj-gh43	Cache Flooding in TYPO3 Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the …	6.2.27 Vulnerable
GHSA-xvcp-33rc-j8gq	Insecure Unserialize in TYPO3 Import/Export Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. …	6.2.26 Vulnerable
GHSA-cg4m-qjjp-7497	TYPO3 Cross-Site Scripting in link validator component Failing to sanitize content from editors, the link validator component is susceptible to …	6.2.18 Vulnerable
GHSA-86r8-4g3w-7xjp	Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A …	6.2.26 Vulnerable
GHSA-6xh8-8pfv-53vx	Authentication Bypass in TYPO3 CMS The default authentication service misses to invalidate empty strings as password. Therefore it is possible …	6.2.20 Vulnerable
GHSA-8j9v-4hhh-x43c	Cross-Site Scripting (XSS) in TYPO3 component CSS styled content Failing to properly encode user input, the CSS styled content component …	6.2.19 Vulnerable
GHSA-hq37-rfjc-mr8h	Cross-Site Scripting (XSS) in TYPO3 Backend Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. …	6.2.27 Vulnerable
GHSA-5wx6-xwxf-q8qj	Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A …	6.2.20 Vulnerable
GHSA-j86x-pjmr-9m6w	SQL Injection in TYPO3 Frontend Login Failing to properly escape user input, the frontend login component is vulnerable to SQL …	6.2.26 Vulnerable
GHSA-vpr3-rc99-2wpr	Information Disclosure in TYPO3 Backend The TYPO3 backend module stores the username of an authenticated backend user in its cache …	6.2.26 Vulnerable
GHSA-v5jp-4h2p-j2p4	Privilege Escalation in TYPO3 CMS The workspace/ version preview link created by a privileged (backend) user could be abused to …	6.2.20 Vulnerable
GHSA-75mx-chcf-2q32	Duplicate Advisory: TYPO3 Cross-Site Scripting vulnerability in typolinks ## Duplicate Advisory This advisory has been withdrawn because it is a …	6.2.16 Vulnerable
GHSA-4r76-xr68-w7m7	TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts It has been …	6.2.14 Vulnerable
GHSA-r9vc-jfmh-6j48	TYPO3 frontend login vulnerable to Session Fixation It has been discovered that TYPO3 is susceptible to session fixation. If a …	6.2.14 Vulnerable
GHSA-r287-hc8j-w56h	TYPO3 Information Disclosure Vulnerability Exploitable by Editors It has been discovered, that editors with access to the file list module …	6.2.14 Vulnerable
GHSA-wp8j-c736-c5r3	TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors It has been discovered that link tags generated by typolink functionality in the …	6.2.14 Vulnerable
GHSA-pqfv-97hj-g97g	TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure It has been discovered, that calling a PHP script which is delivered with …	6.2.15 Vulnerable
GHSA-jqr8-q455-xx45	TYPO3 Brute Force Protection Bypass in backend login The backend login has a basic brute force protection implementation which pauses …	6.2.14 Vulnerable
TYPO3-CORE-SA-2015-012	Cross-Site Scripting vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors …	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2015-89	Cross-site Scripting Multiple Cross-Site Scripting vulnerabilities in frontend.	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2016-156	Uncontrolled Resource Consumption Cache Flooding in TYPO3 Frontend.	8.3.0 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
GMS-2015-91	Cross-site Scripting Cross-Site Scripting in TYPO3 component Indexed Search.	6.2.16 Vulnerable
GMS-2016-135	SQL Injection in dbal.	6.2.18 Vulnerable
TYPO3-CORE-SA-2015-011	Multiple Cross-Site Scripting vulnerabilities in backend Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, …	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2015-25	Unauthenticated Path Disclosure It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, …	6.2.15 Vulnerable 7.4.0 Vulnerable
GMS-2015-87	Cross-site Scripting Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend.	6.2.16 Vulnerable 7.6.1 Vulnerable
TYPO3-CORE-SA-2016-021	Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with …	8.3.1 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
GMS-2015-84	Improper Restriction of Excessive Authentication Attempts Brute Force Protection Bypass in backend login.	6.2.14 Vulnerable 7.3.0 Vulnerable
TYPO3-CORE-SA-2016-023	Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To …	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
GMS-2015-80	Improper Access Control Access bypass when editing file metadata.	6.2.14 Vulnerable 7.3.0 Vulnerable
CVE-2015-5956	Cross-Site Scripting Vulnerability It has been discovered, that it is possible to forge a link to a backend module, which …	6.2.15 Vulnerable 7.4.0 Vulnerable
GMS-2016-158	Path Traversal in TYPO3 Core.	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
GMS-2016-143	Cross-site Scripting Cross-Site Scripting in TYPO3 Backend.	8.0.1 Vulnerable 7.6.5 Vulnerable 6.2.20 Vulnerable
TYPO3-CORE-SA-2016-013	Missing Access Check Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes …	8.1.1 Vulnerable 7.6.8 Vulnerable 6.2.24 Vulnerable
GMS-2016-139	Improper Restriction of XML External Entity Reference XML External Entity (XXE) Processing in TYPO3 Core.	6.2.19 Vulnerable 7.6.4 Vulnerable
GMS-2016-136	Cross-site Scripting Cross-Site Scripting in link validator component.	7.6.3 Vulnerable 6.2.18 Vulnerable
GMS-2016-142	Uncontrolled Resource Consumption Denial of Service attack possibility in TYPO3 component Indexed Search.	6.2.19 Vulnerable 7.6.4 Vulnerable
GMS-2015-90	Cross-site Scripting TYPO3 is susceptible to Cross-Site Flashing.	6.2.16 Vulnerable
CVE-2019-19849	Deserialization of Untrusted Data It has been discovered that the classes `QueryGenerator` and `QueryView` are vulnerable to insecure deserialization. One …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
GMS-2015-81	Frontend login Session Fixation.	6.2.14 Vulnerable 7.3.0 Vulnerable
GMS-2017-347	Code Injection Remote Code Execution in third party library swiftmailer.	8.5.0 Vulnerable 7.6.15 Vulnerable 6.2.30 Vulnerable
TYPO3-CORE-SA-2015-015	Cross-Site Scripting in Indexed Search Failing to properly encode editor input, the search result view of indexed_search is susceptible to …	6.2.16 Vulnerable
GMS-2016-147	Improper Access Control Missing Access Check in TYPO3 CMS.	8.1.1 Vulnerable 7.6.8 Vulnerable 6.2.25 Vulnerable
GMS-2016-144	Information Exposure Arbitrary File Disclosure in Form Component.	6.2.20 Vulnerable
GMS-2016-146	Improper Privilege Management Privilege Escalation in TYPO3 CMS.	8.0.1 Vulnerable 7.6.5 Vulnerable 6.2.20 Vulnerable
GMS-2016-151	Information Disclosure in TYPO3 Backend.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
CVE-2018-6905	Cross-site Scripting The page module in TYPO3 is vulnerable to XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a …	9.1.0 Vulnerable 8.7.11 Vulnerable
GMS-2015-83	Information Disclosure possibility exploitable by Editors.	6.2.14 Vulnerable 7.3.0 Vulnerable
TYPO3-CORE-SA-2015-014	Cross-Site Flashing The flashplayer misses to validate flash and image files. Therefore it is possible to embed flash videos from …	6.2.16 Vulnerable
TYPO3-CORE-SA-2015-013	Multiple Cross-Site Scripting vulnerabilities in frontend Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, …	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2016-149	Deserialization of Untrusted Data Insecure Unserialize in TYPO3 Import/Export.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
GMS-2015-85	Cross-site Scripting Cross-Site Scripting in 3rd party library Flowplayer.	6.2.14 Vulnerable 7.3.0 Vulnerable
GMS-2016-145	Improper Authentication Authentication Bypass in TYPO3 CMS.	8.0.1 Vulnerable 7.6.5 Vulnerable 6.2.20 Vulnerable
CVE-2021-21338 Aliases: GHSA-4jhw-2p6j-5wmp	URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GMS-2015-88	Cross-site Scripting Cross-Site Scripting vulnerability in typolinks.	6.2.16 Vulnerable 7.6.1 Vulnerable
CVE-2020-26227 Aliases: GHSA-vqqx-jw6p-q3rf	Cross-site Scripting TYPO3 is an open source PHP based web content management system. In TYPO3 the system extension Fluid (typo3/cms-fluid) …	8.0.0 Vulnerable 7.0.0 Vulnerable 10.4.10 Vulnerable 9.5.23 Vulnerable
GMS-2016-150	SQL Injection in TYPO3 Frontend Login.	7.6.10 Vulnerable 6.2.26 Vulnerable
GMS-2016-137	Cross-site Scripting Cross-Site Scripting in legacy form component.	6.2.18 Vulnerable
TYPO3-CORE-SA-2016-022	Cache Flooding in Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash …	8.3.1 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
GMS-2015-86	Information Exposure Frontend: Unauthenticated Path Disclosure.	6.2.15 Vulnerable 7.3.0 Vulnerable
GMS-2016-152	Cross-site Scripting Cross-Site Scripting vulnerability in typolinks.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
GMS-2016-141	Cross-site Scripting Cross-Site Scripting in TYPO3 component CSS styled content.	6.2.19 Vulnerable 7.6.4 Vulnerable
GMS-2016-138	Cross-site Scripting Cross-Site Scripting in form component.	6.2.18 Vulnerable
GMS-2016-157	Insecure Deserialization Insecure Unserialize in TYPO3 Backend.	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
CVE-2019-19848	Path Traversal It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
TYPO3-CORE-SA-2016-024	Path Traversal Due to a too loose type check in an API method, attackers could bypass the directory traversal check …	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
GMS-2016-148	Cross-site Scripting Cross-Site Scripting in TYPO3 Backend.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
GMS-2015-82	Cross-site Scripting Cross-Site Scripting exploitable by Editors.	6.2.14 Vulnerable 7.3.0 Vulnerable
CVE-2021-21339 Aliases: GHSA-qx3w-4864-94ch	Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2020-8091	Cross-site Scripting `svg.swf` in TYPO3 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a …	7.2.0 Vulnerable
GMS-2016-155	Cross-site Scripting XSS in TYPO3 Backend.	8.3.0 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
GMS-2016-140	Cross-site Scripting Cross-Site Scripting in TYPO3 component Backend.	6.2.19 Vulnerable
GHSA-56f9-5563-m2h7 Aliases: CVE-2015-8755	Typo3 XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before …	6.2.16 Vulnerable 6.2.16 Vulnerable
GHSA-j5v7-9xr5-m7gx Aliases: CVE-2015-8759	TYPO3 Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before …	6.2.16 Vulnerable 6.2.16 Vulnerable
GHSA-xx7m-8rq2-cw2v Aliases: CVE-2015-8756	TYPO3 CMS indexed search Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search …	6.2.16 Vulnerable 6.2.16 Vulnerable
GHSA-ffcm-vhcw-p32r Aliases: CVE-2016-4056	TYPO3 Backend component Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 …	6.2.19 Vulnerable 6.2.19 Vulnerable
GHSA-3f58-74qw-ph75 Aliases: CVE-2015-8760	TYPO3 allows remote attackers to embed Flash videos from external domain The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows …	6.2.16 Vulnerable 6.2.16 Vulnerable
GHSA-3w22-wrwx-2r75 Aliases: CVE-2018-6905	Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering …	9.2.0 Vulnerable 9.2.0 Vulnerable
CVE-2022-23501 Aliases: GHSA-jfp7-79g7-89rf	TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
GHSA-qvhv-pwww-53jj Aliases: CVE-2020-8091	Typo3 Cross-Site Scripting in Flash component (ELTS) TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external …	7.2.0 Vulnerable
GHSA-jg55-3q6h-2ccf Aliases: CVE-2009-0816	Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.0