VulnerableCode Package Details - pkg:composer/typo3/cms@8.7.32

Vulnerabilities affecting this package (21)

Advisory	Summary	Fixed in package version
GHSA-c5c9-8c6m-727v Aliases: CVE-2021-32768	Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize …	There are no reported fixed by versions.
GHSA-954j-f27r-cj52 Aliases: CVE-2020-26228	Cleartext storage of session identifier User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. …	There are no reported fixed by versions.
GHSA-vqqx-jw6p-q3rf Aliases: CVE-2020-26227	Cross-Site Scripting in Fluid view helpers > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) > * CWE-79 ### Problem It …	There are no reported fixed by versions.
CVE-2021-32767 Aliases: GHSA-34fr-fhqr-7235	Inclusion of Sensitive Information in Log Files TYPO3 is an open source PHP based web content management system. User credentials …	10.4.18 Vulnerable 11.3.1 Vulnerable 9.5.28 Vulnerable
CVE-2021-21357 Aliases: GHSA-3vg7-jw9m-pc3f	Path Traversal Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2021-32768 Aliases: GHSA-c5c9-8c6m-727v	Cross-site Scripting TYPO3 is an open source PHP based web content management system released under the GNU GPL. sanitize and …	10.4.19 Vulnerable 11.3.2 Vulnerable 9.5.29 Vulnerable
CVE-2021-32669 Aliases: GHSA-rgcg-28xm-8mmw	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When settings for `_backend layouts_` are not properly encoded, the corresponding grid …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2021-21338 Aliases: GHSA-4jhw-2p6j-5wmp	URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2020-26227 Aliases: GHSA-vqqx-jw6p-q3rf	Cross-site Scripting TYPO3 is an open source PHP based web content management system. In TYPO3 the system extension Fluid (typo3/cms-fluid) …	8.0.0 Vulnerable 7.0.0 Vulnerable 10.4.10 Vulnerable 9.5.23 Vulnerable
CVE-2021-32668 Aliases: GHSA-6mh3-j5r5-2379	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When error messages are not properly encoded, the components `_QueryGenerator_` and `_QueryView_` …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2021-21370 Aliases: GHSA-x7hc-x7fm-f7qh	Cross-site Scripting Content elements of type `_menu_` are vulnerable to cross-site scripting when their referenced items get previewed in the …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2021-21339 Aliases: GHSA-qx3w-4864-94ch	Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2021-21355 Aliases: GHSA-2r6j-862c-m2v2	Unrestricted Upload of File with Dangerous Type Due to the lack of ensuring file extensions belong to configured allowed mime-types, …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GHSA-3w22-wrwx-2r75 Aliases: CVE-2018-6905	Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering …	9.2.0 Vulnerable 9.2.0 Vulnerable
CVE-2022-23501 Aliases: GHSA-jfp7-79g7-89rf	TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-36107 Aliases: GHSA-9c6w-55cp-5w25	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
CVE-2022-23503 Aliases: GHSA-c5wx-6c2c-f7rm	Improper Control of Generation of Code ('Code Injection') TYPO3 is an open source PHP based web content management system. Versions …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-31047 Aliases: GHSA-fh99-4pgr-8j99	Insertion of Sensitive Information into Log File TYPO3 is an open source web content management system. Prior to versions 7.6.57 …	10.4.29 Vulnerable 11.5.11 Vulnerable 10.4.29 Vulnerable 11.5.11 Vulnerable
CVE-2023-24814 Aliases: GHSA-r4f8-f93x-5qh3	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is a free and open source Content Management Framework …	11.5.23 Vulnerable 12.2.0 Vulnerable 10.4.36 Vulnerable 11.5.23 Vulnerable 12.2.0 Vulnerable 10.4.36 Vulnerable
CVE-2022-36105 Aliases: GHSA-m392-235j-9r7r	Observable Discrepancy TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
GHSA-jg55-3q6h-2ccf Aliases: CVE-2009-0816	Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	3.6