Search for packages
| purl | pkg:composer/typo3/cms@6.2.28 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 2.8 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-gj48-w74w-8gvm
|
Path Traversal in TYPO3 Core Due to a too loose type check in an API method, attackers could bypass the … |
Vulnerable |
|
GHSA-c7rj-92xr-wprg
|
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To … |
Vulnerable |
|
GHSA-g4pf-3jvq-2gcw
|
TYPO3 Remote Code Execution in third party library swiftmailer TYPO3 uses the package swiftmailer/swiftmailer for mail actions. This package is … |
Vulnerable |
|
TYPO3-CORE-SA-2016-023
|
Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2016-158
|
Path Traversal in TYPO3 Core. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-19849
|
Deserialization of Untrusted Data It has been discovered that the classes `QueryGenerator` and `QueryView` are vulnerable to insecure deserialization. One … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2017-347
|
Code Injection Remote Code Execution in third party library swiftmailer. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2018-6905
|
Cross-site Scripting The page module in TYPO3 is vulnerable to XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a … |
Vulnerable Vulnerable |
|
CVE-2021-21338
Aliases: GHSA-4jhw-2p6j-5wmp |
URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-26227
Aliases: GHSA-vqqx-jw6p-q3rf |
Cross-site Scripting TYPO3 is an open source PHP based web content management system. In TYPO3 the system extension Fluid (typo3/cms-fluid) … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GMS-2016-157
|
Insecure Deserialization Insecure Unserialize in TYPO3 Backend. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-19848
|
Path Traversal It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to … |
Vulnerable Vulnerable Vulnerable |
|
TYPO3-CORE-SA-2016-024
|
Path Traversal Due to a too loose type check in an API method, attackers could bypass the directory traversal check … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21339
Aliases: GHSA-qx3w-4864-94ch |
Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8091
|
Cross-site Scripting `svg.swf` in TYPO3 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a … |
Vulnerable |
|
GHSA-3w22-wrwx-2r75
Aliases: CVE-2018-6905 |
Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering … |
Vulnerable Vulnerable |
|
CVE-2022-23501
Aliases: GHSA-jfp7-79g7-89rf |
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-qvhv-pwww-53jj
Aliases: CVE-2020-8091 |
Typo3 Cross-Site Scripting in Flash component (ELTS) TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external … |
Vulnerable |
|
GHSA-jg55-3q6h-2ccf
Aliases: CVE-2009-0816 |
Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided … | There are no reported fixed by versions. |