VulnerableCode Package Details - pkg:composer/typo3/cms@8.0.0

Vulnerabilities affecting this package (127)

Advisory	Summary	Fixed in package version
GHSA-c5c9-8c6m-727v Aliases: CVE-2021-32768	Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize …	There are no reported fixed by versions.
GHSA-86hp-xrhj-fhpq Aliases: CVE-2019-12747	TYPO3 Vulnerable to Insecure Deserialization TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.	8.7.27 Vulnerable
GHSA-r6fv-56gp-j3r4 Aliases: CVE-2019-12748	Typo3 Cross-Site Scripting in Link Handling TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.	8.7.27 Vulnerable
GHSA-gj48-w74w-8gvm	Path Traversal in TYPO3 Core Due to a too loose type check in an API method, attackers could bypass the …	8.4.1 Vulnerable
GHSA-ppgf-8745-8pgx	Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS Phar files (formerly known as "PHP archives") can act als self …	8.7.17 Vulnerable
GHSA-v4qr-8h2v-qpjx	Cross-Site Scripting in TYPO3 CMS Backend Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A …	8.7.5 Vulnerable
GHSA-c5mj-39cf-3pp5	TYPO3 Security Misconfiguration for Backend User Accounts When using the TYPO3 backend in order to create new backend user accounts, …	8.7.23 Vulnerable
GHSA-f3wf-q4fj-3gxf	TYPO3 Denial of Service in Online Media Asset Handling Online Media Asset Handling (`.youtube` and `.vimeo` files) in the TYPO3 …	8.7.21 Vulnerable
GHSA-g585-crjf-vhwq	TYPO3 Denial of Service in Frontend Record Registration TYPO3’s built-in record registration functionality (aka `basic shopping cart`) using recs URL …	8.7.21 Vulnerable
GHSA-gwfx-p7mr-f92v	Missing Access Check in TYPO3 CMS Extbase request handling fails to implement a proper access check for requested controller/ action …	8.1.1 Vulnerable
GHSA-f777-f784-36gm	TYPO3 Security Misconfiguration in Install Tool Cookie It has been discovered that cookies created in the Install Tool are not …	8.7.21 Vulnerable
GHSA-67wg-6j7r-mqh8	Arbitrary Code Execution in TYPO3 CMS Due to a missing file extension in the fileDenyPattern, backend user are allowed to …	8.7.5 Vulnerable
GHSA-7q33-hxwj-7p8v	TYPO3 Cross-Site Scripting in Backend Modal Component Failing to properly encode user input, notifications shown in modal windows in the …	8.7.21 Vulnerable
GHSA-772m-43f3-hmf8	TYPO3 Broken Access Control in Localization Handling It has been discovered that backend users having limited access to specific languages …	8.7.23 Vulnerable
GHSA-g9rv-6g56-65h8	Typo3 Security Misconfiguration in User Session Handling When users change their password existing sessions for that particular user account are …	8.7.25 Vulnerable
GHSA-g7hw-jh4p-75wr	TYPO3 Cross-Site Scripting in Filelist Module It has been discovered that the output table listing in the “Files” backend module …	8.7.30 Vulnerable
GHSA-g46h-v2cc-6c94	Information Disclosure in TYPO3 CMS Failing to properly check user permission on file storages, editors could gain knowledge of protected …	8.7.5 Vulnerable
GHSA-qmwf-j7g7-f5jw	Cross-Site Scripting in third party library mso/idna-convert Make sure to not expose the vendor directory to the publicly accessible document …	8.2.1 Vulnerable
GHSA-c7rj-92xr-wprg	Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To …	8.4.1 Vulnerable
GHSA-q9c4-9v5m-597p	Typo3 Information Disclosure in Backend User Interface The element information component used to display properties of a certain record is …	8.7.27 Vulnerable
GHSA-6487-3qvg-8px9	TYPO3 Information Disclosure in Install Tool The Install Tool exposes the current TYPO3 version number to non-authenticated users.	8.7.21 Vulnerable
GHSA-v8m4-3w37-ghxx	TYPO3 Cross-Site Scripting in Form Framework validation handling It has been discovered that the output of field validation errors in …	8.7.30 Vulnerable
GHSA-85ch-44w7-rf32	TYPO3 Cross-Site Scripting in Fluid ViewHelpers Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to …	8.7.23 Vulnerable
GHSA-hww5-6x85-mc24	Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API Backend API configuration using Page TSconfig is vulnerable to arbitrary …	8.7.27 Vulnerable
GHSA-g4pf-3jvq-2gcw	TYPO3 Remote Code Execution in third party library swiftmailer TYPO3 uses the package swiftmailer/swiftmailer for mail actions. This package is …	8.5.1 Vulnerable
GHSA-4h5c-5g25-v7fh	TYPO3 Cross-Site Scripting in Form Framework Failing to properly encode user input, frontend forms handled by the form framework (system …	8.7.23 Vulnerable
GHSA-c7p6-3c9c-f88q	Information Disclosure in TYPO3 CMS HTTP requests being performed using the TYPO3 API expose the specific TYPO3 version to the …	8.7.5 Vulnerable
GHSA-f624-8hfq-5fh3	TYPO3 Information Disclosure of Installed Extensions It has been discovered that mechanisms used for configuration of RequireJS package loading are …	8.7.23 Vulnerable
GHSA-p5c5-gmj4-g48f	Cross-Site Scripting (XSS) vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized …	8.2.1 Vulnerable
GHSA-5gr6-97fv-52cc	Cross-Site Scripting in TYPO3 CMS Failing to properly encode user input, several places of the TYPO3 CMS are vulnerable to …	8.6.1 Vulnerable
GHSA-pw2q-qwvj-gh43	Cache Flooding in TYPO3 Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the …	8.3.1 Vulnerable
GHSA-xvcp-33rc-j8gq	Insecure Unserialize in TYPO3 Import/Export Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. …	8.2.1 Vulnerable
GHSA-86r8-4g3w-7xjp	Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A …	8.2.1 Vulnerable
GHSA-6f9m-v7mp-7jjq	Authentication Bypass in TYPO3 CMS It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system …	8.7.17 Vulnerable
GHSA-6xh8-8pfv-53vx	Authentication Bypass in TYPO3 CMS The default authentication service misses to invalidate empty strings as password. Therefore it is possible …	8.0.1 Vulnerable
GHSA-hq37-rfjc-mr8h	Cross-Site Scripting (XSS) in TYPO3 Backend Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. …	8.3.1 Vulnerable
GHSA-qr5f-6fcv-w69q	Typo3 Security Misconfiguration in Frontend Session Handling It has been discovered session data of properly authenticated and logged in frontend …	8.7.27 Vulnerable
GHSA-8h4m-r4wm-xj7r	TYPO3 Arbitrary Code Execution via File List Module Due to missing file extensions in $GLOBALS['TYPO3_CONF_VARS']['BE'][‘fileDenyPattern’], backend users are allowed to …	8.7.23 Vulnerable
GHSA-hh95-5xm5-v8v7	TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling It has been discovered that request handling in Extbase can be …	8.7.30 Vulnerable
GHSA-xgmx-j3hv-jh9x	TYPO3 Cross-Site Scripting in Link Handling It has been discovered that `t3://` URL handling and typolink functionality are vulnerable to …	8.7.30 Vulnerable
GHSA-2rcw-9hrm-8q7q	TYPO3 Cross-Site Scripting in Frontend User Login Failing to properly encode user input, login status display is vulnerable to cross-site …	8.7.21 Vulnerable
GHSA-5wx6-xwxf-q8qj	Cross-Site Scripting in TYPO3 Backend Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A …	8.0.1 Vulnerable
GHSA-8m6j-p5jv-v69w	TYPO3 Cross-Site Scripting in Online Media Asset Rendering Failing to properly encode user input, online media asset rendering (`*.youtube` and …	8.7.21 Vulnerable
GHSA-vpr3-rc99-2wpr	Information Disclosure in TYPO3 Backend The TYPO3 backend module stores the username of an authenticated backend user in its cache …	8.2.1 Vulnerable
GHSA-v5jp-4h2p-j2p4	Privilege Escalation in TYPO3 CMS The workspace/ version preview link created by a privileged (backend) user could be abused to …	8.0.1 Vulnerable
GHSA-7733-hjv6-4h47 Aliases: CVE-2020-15241	Cross-Site Scripting in ternary conditional operator > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0) > * CWE-79 --- :information_source:  This vulnerability …	8.7.25 Vulnerable
GMS-2019-174	Improper Access Control Broken Access Control in Localization Handling.	8.7.23 Vulnerable
CVE-2021-32767 Aliases: GHSA-34fr-fhqr-7235	Inclusion of Sensitive Information in Log Files TYPO3 is an open source PHP based web content management system. User credentials …	10.4.18 Vulnerable 11.3.1 Vulnerable 9.5.28 Vulnerable
GMS-2019-182	Code Injection Possible Arbitrary Code Execution in Image Processing.	8.7.25 Vulnerable 9.5.6 Vulnerable
GMS-2016-156	Uncontrolled Resource Consumption Cache Flooding in TYPO3 Frontend.	8.3.0 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
GMS-2018-98	Cross-site Scripting Cross-Site Scripting in Backend Modal Component.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
GMS-2019-176	Cross-site Scripting Cross-Site Scripting in Bootstrap CSS toolkit.	8.7.23 Vulnerable 9.5.4 Vulnerable
GMS-2018-102	Uncontrolled Resource Consumption Denial of Service in Online Media Asset Handling.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
TYPO3-CORE-SA-2017-005	Information Disclosure Failing to properly check user permission on file storages, editors could gain knowledge of protected storages and its …	8.7.5 Vulnerable 7.6.22 Vulnerable
GMS-2019-175	Cross-site Scripting Cross-Site Scripting in Fluid `ViewHelpers`.	8.7.23 Vulnerable 9.5.4 Vulnerable
GMS-2019-172	Information Disclosure of Installed Extensions.	8.7.23 Vulnerable 9.5.4 Vulnerable
TYPO3-CORE-SA-2016-023	Insecure Unserialize in TYPO3 Backend Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To …	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
GMS-2016-158	Path Traversal in TYPO3 Core.	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
GMS-2018-99	Cross-site Scripting Cross-Site Scripting in Frontend User Login.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
CVE-2021-21357 Aliases: GHSA-3vg7-jw9m-pc3f	Path Traversal Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GMS-2016-143	Cross-site Scripting Cross-Site Scripting in TYPO3 Backend.	8.0.1 Vulnerable 7.6.5 Vulnerable 6.2.20 Vulnerable
GMS-2016-154	Cross-site Scripting Cross-Site Scripting in third party library `mso/idna-convert`.	8.2.1 Vulnerable 7.6.10 Vulnerable
TYPO3-CORE-SA-2016-013	Missing Access Check Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes …	8.1.1 Vulnerable 7.6.8 Vulnerable 6.2.24 Vulnerable
GMS-2017-351	Information Disclosure in TYPO3 CMS.	8.7.0 Vulnerable 7.6.22 Vulnerable
GMS-2019-189	Insecure Deserialization in TYPO3 CMS.	8.7.27 Vulnerable 9.5.8 Vulnerable
CVE-2019-19849	Deserialization of Untrusted Data It has been discovered that the classes `QueryGenerator` and `QueryView` are vulnerable to insecure deserialization. One …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
CVE-2021-32768 Aliases: GHSA-c5c9-8c6m-727v	Cross-site Scripting TYPO3 is an open source PHP based web content management system released under the GNU GPL. sanitize and …	10.4.19 Vulnerable 11.3.2 Vulnerable 9.5.29 Vulnerable
GMS-2017-347	Code Injection Remote Code Execution in third party library swiftmailer.	8.5.0 Vulnerable 7.6.15 Vulnerable 6.2.30 Vulnerable
TYPO3-CORE-SA-2017-003	XSS Vulnerability TYPO3 is vulnerable to Cross-Site Scripting.	8.6.1 Vulnerable 7.6.16 Vulnerable
GMS-2019-188	Code Injection Arbitrary Code Execution and Cross-Site Scripting in Backend API.	8.7.27 Vulnerable 9.5.8 Vulnerable
GMS-2016-147	Improper Access Control Missing Access Check in TYPO3 CMS.	8.1.1 Vulnerable 7.6.8 Vulnerable 6.2.25 Vulnerable
GMS-2018-103	Uncontrolled Resource Consumption Denial of Service in Frontend Record Registration.	8.7.21 Vulnerable 7.6.32 Vulnerable
GMS-2018-93	Improper Authentication Authentication Bypass in TYPO3 CMS.	9.3.2 Vulnerable 8.7.17 Vulnerable 7.6.30 Vulnerable
GMS-2017-349	Cross-site Scripting XSS in TYPO3 CMS.	8.6.1 Vulnerable 7.6.16 Vulnerable
GMS-2016-146	Improper Privilege Management Privilege Escalation in TYPO3 CMS.	8.0.1 Vulnerable 7.6.5 Vulnerable 6.2.20 Vulnerable
GMS-2019-180	Cross-site Scripting Cross-Site Scripting in Fluid Engine.	8.7.25 Vulnerable 9.5.6 Vulnerable
GMS-2016-151	Information Disclosure in TYPO3 Backend.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
TYPO3-CORE-SA-2017-002	Authentication Bypass Due to late TCA initialization the authentication service fails to restrict frontend user according to the validation rules. …	8.6.1 Vulnerable
GMS-2018-97	Cross-site Scripting Cross-Site Scripting in Online Media Asset Rendering.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
CVE-2018-6905	Cross-site Scripting The page module in TYPO3 is vulnerable to XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a …	9.1.0 Vulnerable 8.7.11 Vulnerable
TYPO3-CORE-SA-2017-004	XSS Vulnerability Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A valid backend user account …	8.7.5 Vulnerable
GMS-2019-186	Cross-site Scripting Cross-Site Scripting in Link Handling.	8.7.27 Vulnerable 9.5.8 Vulnerable
GMS-2019-185	Information Disclosure in Backend User Interface.	8.7.27 Vulnerable 9.5.8 Vulnerable
GMS-2018-94	Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS.	9.3.2 Vulnerable 8.7.17 Vulnerable 7.6.30 Vulnerable
GMS-2016-149	Deserialization of Untrusted Data Insecure Unserialize in TYPO3 Import/Export.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
GMS-2019-177	Cross-site Scripting Cross-Site Scripting in Form Framework.	8.7.23 Vulnerable 9.5.4 Vulnerable
GMS-2017-353	Code Injection Arbitrary Code Execution in TYPO3 CMS.	8.7.0 Vulnerable 7.6.22 Vulnerable
CVE-2021-32669 Aliases: GHSA-rgcg-28xm-8mmw	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When settings for `_backend layouts_` are not properly encoded, the corresponding grid …	10.4.18 Vulnerable 11.3.1 Vulnerable
GMS-2016-145	Improper Authentication Authentication Bypass in TYPO3 CMS.	8.0.1 Vulnerable 7.6.5 Vulnerable 6.2.20 Vulnerable
CVE-2021-21338 Aliases: GHSA-4jhw-2p6j-5wmp	URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GMS-2016-153	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Environment Variable Injection.	8.2.1 Vulnerable
GMS-2017-350	Cross-site Scripting XSS in TYPO3 CMS Backend.	8.7.0 Vulnerable
TYPO3-CORE-SA-2017-007	Arbitrary Code Execution Due to a missing file extension in the `fileDenyPattern`, backend user are allowed to upload *.pht files …	8.7.5 Vulnerable 7.6.22 Vulnerable
GMS-2019-187	Security Misconfiguration in Frontend Session Handling.	8.7.27 Vulnerable 9.5.8 Vulnerable
CVE-2021-32668 Aliases: GHSA-6mh3-j5r5-2379	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When error messages are not properly encoded, the components `_QueryGenerator_` and `_QueryView_` …	10.4.18 Vulnerable 11.3.1 Vulnerable
GMS-2018-101	Information Disclosure in Install Tool.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
GMS-2019-181	Security Misconfiguration in User Session Handling.	8.7.25 Vulnerable 9.5.6 Vulnerable
TYPO3-CORE-SA-2017-006	Information Disclosure HTTP requests being performed using the TYPO3 API expose the specific TYPO3 version to the called endpoint.	8.7.5 Vulnerable 7.6.22 Vulnerable
CVE-2021-21370 Aliases: GHSA-x7hc-x7fm-f7qh	Cross-site Scripting Content elements of type `_menu_` are vulnerable to cross-site scripting when their referenced items get previewed in the …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GMS-2016-152	Cross-site Scripting Cross-Site Scripting vulnerability in typolinks.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
GMS-2019-178	Code Injection Arbitrary Code Execution via File List Module.	8.7.23 Vulnerable 9.5.4 Vulnerable
GMS-2016-157	Insecure Deserialization Insecure Unserialize in TYPO3 Backend.	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
GMS-2019-173	Security Misconfiguration for Backend User Accounts.	8.7.23 Vulnerable 9.5.4 Vulnerable
CVE-2019-19848	Path Traversal It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
TYPO3-CORE-SA-2016-024	Path Traversal Due to a too loose type check in an API method, attackers could bypass the directory traversal check …	8.4.1 Vulnerable 7.6.13 Vulnerable 6.2.29 Vulnerable
GMS-2018-104	Cross-site Scripting Cross-Site Scripting in CKEditor.	8.7.21 Vulnerable 9.5.2 Vulnerable
GMS-2016-148	Cross-site Scripting Cross-Site Scripting in TYPO3 Backend.	8.2.1 Vulnerable 7.6.10 Vulnerable 6.2.26 Vulnerable
GMS-2018-100	Security Misconfiguration in Install Tool Cookie.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
GMS-2017-352	Information Disclosure in TYPO3 CMS.	8.7.0 Vulnerable 7.6.22 Vulnerable
CVE-2021-21339 Aliases: GHSA-qx3w-4864-94ch	Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GMS-2016-155	Cross-site Scripting XSS in TYPO3 Backend.	8.3.0 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
CVE-2021-21355 Aliases: GHSA-2r6j-862c-m2v2	Unrestricted Upload of File with Dangerous Type Due to the lack of ensuring file extensions belong to configured allowed mime-types, …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GHSA-g68x-vvqq-pvw3 Aliases: CVE-2018-17960	Ckeditor XSS Vulnerability CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS …	8.7.21 Vulnerable 8.7.21 Vulnerable
GHSA-pj7m-g53m-7638 Aliases: CVE-2018-14041	Bootstrap Cross-site Scripting vulnerability In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is …	8.7.23 Vulnerable 8.7.23 Vulnerable
GHSA-59pj-7mjh-4465 Aliases: CVE-2019-19850	TYPO3 SQL Injection in low-level Query Generator An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x …	8.7.30 Vulnerable 8.7.30 Vulnerable
GHSA-rcgc-4xfc-564v Aliases: CVE-2019-19849	TYPO3 Insecure Deserialization in Query Generator & Query View An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, …	8.7.30 Vulnerable 8.7.30 Vulnerable
GHSA-fh4q-hxrw-cjqq Aliases: CVE-2017-14251	TYPO3 Arbitrary Code Execution Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 …	8.7.5 Vulnerable 8.7.5 Vulnerable
GHSA-77p4-wfr8-977w Aliases: CVE-2019-19848	TYPO3 Directory Traversal on ZIP extraction An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before …	8.7.30 Vulnerable 8.7.30 Vulnerable
GHSA-3w22-wrwx-2r75 Aliases: CVE-2018-6905	Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering …	9.2.0 Vulnerable 9.2.0 Vulnerable
GHSA-3w4h-r27h-4r2w Aliases: CVE-2019-11832	TYPO3 Image Processing susceptible to Code Execution TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code …	8.7.25 Vulnerable 8.7.25 Vulnerable
CVE-2022-23501 Aliases: GHSA-jfp7-79g7-89rf	TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2016-5385 Aliases: GHSA-m6ch-gg5f-wxx3	URL Redirection to Untrusted Site ('Open Redirect') PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace …	8.2.1 Vulnerable 8.2.1 Vulnerable
CVE-2022-36107 Aliases: GHSA-9c6w-55cp-5w25	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
CVE-2022-23503 Aliases: GHSA-c5wx-6c2c-f7rm	Improper Control of Generation of Code ('Code Injection') TYPO3 is an open source PHP based web content management system. Versions …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-31047 Aliases: GHSA-fh99-4pgr-8j99	Insertion of Sensitive Information into Log File TYPO3 is an open source web content management system. Prior to versions 7.6.57 …	10.4.29 Vulnerable 11.5.11 Vulnerable 10.4.29 Vulnerable 11.5.11 Vulnerable
CVE-2022-36105 Aliases: GHSA-m392-235j-9r7r	Observable Discrepancy TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
GHSA-jg55-3q6h-2ccf Aliases: CVE-2009-0816	Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.5