VulnerableCode Package Details - pkg:composer/typo3/cms@9.5.7

Vulnerabilities affecting this package (64)

Advisory	Summary	Fixed in package version
GHSA-8mq9-fqv8-59wf Aliases: CVE-2021-32667	Cross-Site Scripting in Page Preview > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.0) ### Problem Failing to properly encode _Page …	9.5.28 Vulnerable
GHSA-rgcg-28xm-8mmw Aliases: CVE-2021-32669	Cross-Site Scripting in Backend Grid View ### Problem Failing to properly encode settings for _backend layouts_, the corresponding grid view …	9.5.28 Vulnerable
GHSA-34fr-fhqr-7235 Aliases: CVE-2021-32767	Information Disclosure in User Authentication > ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that …	9.5.28 Vulnerable
GHSA-6mh3-j5r5-2379 Aliases: CVE-2021-32668	Cross-Site Scripting in Query Generator & Query View > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5) ### Problem Failing to …	9.5.28 Vulnerable
GHSA-c5c9-8c6m-727v Aliases: CVE-2021-32768	Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize …	9.5.29 Vulnerable
GHSA-4p9g-qgx9-397p Aliases: CVE-2021-21359	Denial of Service in Page Error Handling > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C` (5.5) > * CWE-405, CWE-674 > …	9.5.25 Vulnerable
GHSA-86hp-xrhj-fhpq Aliases: CVE-2019-12747	TYPO3 Vulnerable to Insecure Deserialization TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.	9.5.8 Vulnerable
GHSA-r6fv-56gp-j3r4 Aliases: CVE-2019-12748	Typo3 Cross-Site Scripting in Link Handling TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.	9.5.8 Vulnerable
GHSA-g7hw-jh4p-75wr	TYPO3 Cross-Site Scripting in Filelist Module It has been discovered that the output table listing in the “Files” backend module …	9.5.12 Vulnerable
GHSA-q9c4-9v5m-597p	Typo3 Information Disclosure in Backend User Interface The element information component used to display properties of a certain record is …	9.5.8 Vulnerable
GHSA-f5rr-9r84-wwqf	Typo3 Broken Access Control in Import Module It has been discovered that the Import/Export module is susceptible to broken access …	9.5.8 Vulnerable
GHSA-v8m4-3w37-ghxx	TYPO3 Cross-Site Scripting in Form Framework validation handling It has been discovered that the output of field validation errors in …	9.5.12 Vulnerable
GHSA-hww5-6x85-mc24	Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API Backend API configuration using Page TSconfig is vulnerable to arbitrary …	9.5.8 Vulnerable
GHSA-qr5f-6fcv-w69q	Typo3 Security Misconfiguration in Frontend Session Handling It has been discovered session data of properly authenticated and logged in frontend …	9.5.8 Vulnerable
GHSA-hh95-5xm5-v8v7	TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling It has been discovered that request handling in Extbase can be …	9.5.12 Vulnerable
GHSA-xgmx-j3hv-jh9x	TYPO3 Cross-Site Scripting in Link Handling It has been discovered that `t3://` URL handling and typolink functionality are vulnerable to …	9.5.12 Vulnerable
GHSA-954j-f27r-cj52 Aliases: CVE-2020-26228	Cleartext storage of session identifier User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. …	9.5.23 Vulnerable
GHSA-vqqx-jw6p-q3rf Aliases: CVE-2020-26227	Cross-Site Scripting in Fluid view helpers > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) > * CWE-79 ### Problem It …	9.5.23 Vulnerable
GHSA-2rxh-h6h9-qrqc Aliases: CVE-2020-11066	Class destructors causing side-effects when being unserialized in TYPO3 CMS Calling unserialize() on malicious user-submitted content can result in the …	9.5.17 Vulnerable
GHSA-pqg8-crx9-g8m4 Aliases: CVE-2020-11069	Backend Same-Site Request Forgery in TYPO3 CMS > ### Meta > * CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C > * CWE-352 > * …	9.5.17 Vulnerable
GHSA-4j77-gg36-9864 Aliases: CVE-2020-11065	Cross-Site Scripting in TYPO3 CMS Link Handling It has been discovered that link tags generated by `typolink` functionality are vulnerable …	9.5.17 Vulnerable
GHSA-43gj-mj2w-wh46 Aliases: CVE-2020-11064	Cross-Site Scripting in TYPO3 CMS Form Engine In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 …	9.5.17 Vulnerable
GHSA-2wj9-434x-9hvp Aliases: CVE-2020-11067	Insecure Deserialization in Backend User Settings in TYPO3 CMS It has been discovered that backend user settings (in $BE_USER->uc) are …	9.5.17 Vulnerable
GHSA-m5vr-3m74-jwxp Aliases: CVE-2020-15098	Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2) …	9.5.20 Vulnerable
GHSA-3x94-fv5h-5q2c Aliases: CVE-2020-15099	Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5) > …	9.5.20 Vulnerable
CVE-2021-32767 Aliases: GHSA-34fr-fhqr-7235	Inclusion of Sensitive Information in Log Files TYPO3 is an open source PHP based web content management system. User credentials …	10.4.18 Vulnerable 11.3.1 Vulnerable 9.5.28 Vulnerable
GMS-2019-191	Improper Access Control Broken Access Control in Import Module.	9.5.8 Vulnerable
CVE-2021-21357 Aliases: GHSA-3vg7-jw9m-pc3f	Path Traversal Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GMS-2019-189	Insecure Deserialization in TYPO3 CMS.	8.7.27 Vulnerable 9.5.8 Vulnerable
CVE-2019-19849	Deserialization of Untrusted Data It has been discovered that the classes `QueryGenerator` and `QueryView` are vulnerable to insecure deserialization. One …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
CVE-2021-32768 Aliases: GHSA-c5c9-8c6m-727v	Cross-site Scripting TYPO3 is an open source PHP based web content management system released under the GNU GPL. sanitize and …	10.4.19 Vulnerable 11.3.2 Vulnerable 9.5.29 Vulnerable
GMS-2019-188	Code Injection Arbitrary Code Execution and Cross-Site Scripting in Backend API.	8.7.27 Vulnerable 9.5.8 Vulnerable
CVE-2019-12748	Cross-site Scripting TYPO3 allows XSS.	8.7.27 Vulnerable 9.5.8 Vulnerable
GMS-2019-186	Cross-site Scripting Cross-Site Scripting in Link Handling.	8.7.27 Vulnerable 9.5.8 Vulnerable
GMS-2019-185	Information Disclosure in Backend User Interface.	8.7.27 Vulnerable 9.5.8 Vulnerable
GMS-2019-190	Deserialization of Untrusted Data Possible deserialization side-effects in `symfony/cache`.	9.5.8 Vulnerable
CVE-2021-32667 Aliases: GHSA-8mq9-fqv8-59wf	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When `_Page` `TSconfig_` settings are not properly encoded, corresponding page preview module …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2021-32669 Aliases: GHSA-rgcg-28xm-8mmw	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When settings for `_backend layouts_` are not properly encoded, the corresponding grid …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2021-21338 Aliases: GHSA-4jhw-2p6j-5wmp	URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2020-26227 Aliases: GHSA-vqqx-jw6p-q3rf	Cross-site Scripting TYPO3 is an open source PHP based web content management system. In TYPO3 the system extension Fluid (typo3/cms-fluid) …	8.0.0 Vulnerable 7.0.0 Vulnerable 10.4.10 Vulnerable 9.5.23 Vulnerable
GMS-2019-187	Security Misconfiguration in Frontend Session Handling.	8.7.27 Vulnerable 9.5.8 Vulnerable
CVE-2021-32668 Aliases: GHSA-6mh3-j5r5-2379	Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When error messages are not properly encoded, the components `_QueryGenerator_` and `_QueryView_` …	10.4.18 Vulnerable 11.3.1 Vulnerable
CVE-2021-21370 Aliases: GHSA-x7hc-x7fm-f7qh	Cross-site Scripting Content elements of type `_menu_` are vulnerable to cross-site scripting when their referenced items get previewed in the …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2020-26228 Aliases: GHSA-954j-f27r-cj52	Cleartext Storage of Sensitive Information TYPO3 is an open source PHP based web content management system. In TYPO3 user session …	10.4.10 Vulnerable 9.5.23 Vulnerable
CVE-2019-19848	Path Traversal It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
CVE-2021-21339 Aliases: GHSA-qx3w-4864-94ch	Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2021-21355 Aliases: GHSA-2r6j-862c-m2v2	Unrestricted Upload of File with Dangerous Type Due to the lack of ensuring file extensions belong to configured allowed mime-types, …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GHSA-59pj-7mjh-4465 Aliases: CVE-2019-19850	TYPO3 SQL Injection in low-level Query Generator An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x …	9.5.12 Vulnerable 9.5.12 Vulnerable
GHSA-rcgc-4xfc-564v Aliases: CVE-2019-19849	TYPO3 Insecure Deserialization in Query Generator & Query View An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, …	9.5.12 Vulnerable 9.5.12 Vulnerable
GHSA-77p4-wfr8-977w Aliases: CVE-2019-19848	TYPO3 Directory Traversal on ZIP extraction An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before …	9.5.12 Vulnerable 9.5.12 Vulnerable
GHSA-w2fr-65vp-mxw3 Aliases: CVE-2019-10912	Deserialization of untrusted data in Symfony In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, …	9.5.8 Vulnerable 9.5.8 Vulnerable
CVE-2022-23501 Aliases: GHSA-jfp7-79g7-89rf	TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-36107 Aliases: GHSA-9c6w-55cp-5w25	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
CVE-2022-23503 Aliases: GHSA-c5wx-6c2c-f7rm	Improper Control of Generation of Code ('Code Injection') TYPO3 is an open source PHP based web content management system. Versions …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-23500 Aliases: GHSA-8c28-5mp7-v24h	Uncontrolled Recursion TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, …	10.4.33 Vulnerable 11.5.20 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable
CVE-2022-31047 Aliases: GHSA-fh99-4pgr-8j99	Insertion of Sensitive Information into Log File TYPO3 is an open source web content management system. Prior to versions 7.6.57 …	10.4.29 Vulnerable 11.5.11 Vulnerable 10.4.29 Vulnerable 11.5.11 Vulnerable
CVE-2023-24814 Aliases: GHSA-r4f8-f93x-5qh3	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is a free and open source Content Management Framework …	11.5.23 Vulnerable 12.2.0 Vulnerable 10.4.36 Vulnerable 11.5.23 Vulnerable 12.2.0 Vulnerable 10.4.36 Vulnerable
CVE-2022-36105 Aliases: GHSA-m392-235j-9r7r	Observable Discrepancy TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
GHSA-4jhw-2p6j-5wmp Aliases: CVE-2021-21338	Open Redirection in Login Handling ### Problem It has been discovered that Login Handling is susceptible to open redirection which …	9.5.25 Vulnerable 9.5.25 Vulnerable
GHSA-3vg7-jw9m-pc3f Aliases: CVE-2021-21357	Broken Access Control in Form Framework ### Problem Due to improper input validation, attackers can by-pass restrictions of predefined options …	9.5.25 Vulnerable 9.5.25 Vulnerable
GHSA-qx3w-4864-94ch Aliases: CVE-2021-21339	Cleartext storage of session identifier ### Problem User session identifiers were stored in cleartext - without processing of additional cryptographic …	9.5.25 Vulnerable 9.5.25 Vulnerable
GHSA-x7hc-x7fm-f7qh Aliases: CVE-2021-21370	Cross-Site Scripting in Content Preview (CType menu) ### Problem It has been discovered that content elements of type _menu_ are …	9.5.25 Vulnerable 9.5.25 Vulnerable
GHSA-2r6j-862c-m2v2 Aliases: CVE-2021-21355	Unrestricted File Upload in Form Framework ### Problem Due to the lack of ensuring file extensions belong to configured allowed …	9.5.25 Vulnerable 9.5.25 Vulnerable
GHSA-jg55-3q6h-2ccf Aliases: CVE-2009-0816	Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.0