Search for packages
| purl | pkg:composer/typo3/cms@6.2.26 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 2.8 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-gj48-w74w-8gvm
|
Path Traversal in TYPO3 Core Due to a too loose type check in an API method, attackers could bypass the … |
Vulnerable |
|
GHSA-c7rj-92xr-wprg
|
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To … |
Vulnerable |
|
GHSA-g4pf-3jvq-2gcw
|
TYPO3 Remote Code Execution in third party library swiftmailer TYPO3 uses the package swiftmailer/swiftmailer for mail actions. This package is … |
Vulnerable |
|
GHSA-pw2q-qwvj-gh43
|
Cache Flooding in TYPO3 Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the … |
Vulnerable |
|
GHSA-hq37-rfjc-mr8h
|
Cross-Site Scripting (XSS) in TYPO3 Backend Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. … |
Vulnerable |
|
GMS-2016-156
|
Uncontrolled Resource Consumption Cache Flooding in TYPO3 Frontend. |
Vulnerable Vulnerable Vulnerable |
|
TYPO3-CORE-SA-2016-021
|
Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with … |
Vulnerable Vulnerable Vulnerable |
|
TYPO3-CORE-SA-2016-023
|
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2016-158
|
Path Traversal in TYPO3 Core. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-19849
|
Deserialization of Untrusted Data It has been discovered that the classes `QueryGenerator` and `QueryView` are vulnerable to insecure deserialization. One … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2017-347
|
Code Injection Remote Code Execution in third party library swiftmailer. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2018-6905
|
Cross-site Scripting The page module in TYPO3 is vulnerable to XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a … |
Vulnerable Vulnerable |
|
CVE-2021-21338
Aliases: GHSA-4jhw-2p6j-5wmp |
URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-26227
Aliases: GHSA-vqqx-jw6p-q3rf |
Cross-site Scripting TYPO3 is an open source PHP based web content management system. In TYPO3 the system extension Fluid (typo3/cms-fluid) … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
TYPO3-CORE-SA-2016-022
|
Cache Flooding in Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2016-157
|
Insecure Deserialization Insecure Unserialize in TYPO3 Backend. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-19848
|
Path Traversal It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to … |
Vulnerable Vulnerable Vulnerable |
|
TYPO3-CORE-SA-2016-024
|
Path Traversal Due to a too loose type check in an API method, attackers could bypass the directory traversal check … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21339
Aliases: GHSA-qx3w-4864-94ch |
Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8091
|
Cross-site Scripting `svg.swf` in TYPO3 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a … |
Vulnerable |
|
GMS-2016-155
|
Cross-site Scripting XSS in TYPO3 Backend. |
Vulnerable Vulnerable Vulnerable |
|
GHSA-3w22-wrwx-2r75
Aliases: CVE-2018-6905 |
Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering … |
Vulnerable Vulnerable |
|
CVE-2022-23501
Aliases: GHSA-jfp7-79g7-89rf |
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-qvhv-pwww-53jj
Aliases: CVE-2020-8091 |
Typo3 Cross-Site Scripting in Flash component (ELTS) TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external … |
Vulnerable |
|
GHSA-jg55-3q6h-2ccf
Aliases: CVE-2009-0816 |
Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-p5c5-gmj4-g48f
|
Cross-Site Scripting (XSS) vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized … | |
|
GHSA-xvcp-33rc-j8gq
|
Insecure Unserialize in TYPO3 Import/Export Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. … | |
|
GHSA-86r8-4g3w-7xjp
|
Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A … | |
|
GHSA-j86x-pjmr-9m6w
|
SQL Injection in TYPO3 Frontend Login Failing to properly escape user input, the frontend login component is vulnerable to SQL … | |
|
GHSA-vpr3-rc99-2wpr
|
Information Disclosure in TYPO3 Backend The TYPO3 backend module stores the username of an authenticated backend user in its cache … | |
|
GMS-2016-151
|
Information Disclosure in TYPO3 Backend. | |
|
GMS-2016-149
|
Deserialization of Untrusted Data Insecure Unserialize in TYPO3 Import/Export. | |
|
GMS-2016-150
|
SQL Injection in TYPO3 Frontend Login. | |
|
GMS-2016-152
|
Cross-site Scripting Cross-Site Scripting vulnerability in typolinks. | |
|
GMS-2016-148
|
Cross-site Scripting Cross-Site Scripting in TYPO3 Backend. |