Packagist (Composer) package
typo3/cms
pkg:composer/typo3/cms
Vulnerabilities (116)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-12748 | Med | 6.1 | >= 8.0.0, < 8.7.27 | 8.7.27 | Jul 9, 2019 | TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. | |
| CVE-2019-12747 | Hig | 8.8 | >= 8.0.0, < 8.7.27 | 8.7.27 | Jul 9, 2019 | TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. | |
| CVE-2019-10912 | Hig | 7.1 | >= 9.0.0, < 9.5.8 | 9.5.8 | May 16, 2019 | In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is re | |
| CVE-2019-11832 | Hig | 7.5 | >= 8.0.0, < 8.7.25 | 8.7.25 | May 9, 2019 | TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. | |
| CVE-2018-17960 | Med | 6.1 | >= 8.0.0, < 8.7.21 | 8.7.21 | Nov 14, 2018 | CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. | |
| CVE-2018-14041 | Med | 6.1 | >= 8.0.0, < 8.7.23 | 8.7.23 | Jul 13, 2018 | In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. | |
| CVE-2018-6905 | Med | 4.8 | < 9.2.0 | 9.2.0 | Apr 8, 2018 | The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process. | |
| CVE-2017-14251 | Hig | 8.8 | >= 7.6.0, < 7.6.22 | 7.6.22 | Sep 11, 2017 | Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code. | |
| CVE-2017-6370 | Med | 5.3 | — | — | Mar 17, 2017 | TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields. | |
| CVE-2016-4056 | Med | 6.1 | >= 6.2.0, < 6.2.19 | 6.2.19 | Jan 23, 2017 | Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark. | |
| CVE-2015-8760 | Med | 6.1 | >= 6.2.0, < 6.2.16 | 6.2.16 | Jan 8, 2016 | The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing." | |
| CVE-2015-8759 | Med | 5.4 | >= 6.2.0, < 6.2.16 | 6.2.16 | Jan 8, 2016 | Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field. | |
| CVE-2015-8756 | Med | 5.4 | >= 6.2.0, < 6.2.16 | 6.2.16 | Jan 8, 2016 | Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated editors to inject arbitrary web script or HTML via unspecified vectors. | |
| CVE-2015-8755 | Med | 5.4 | >= 6.2, < 6.2.16 | 6.2.16 | Jan 8, 2016 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors. | |
| CVE-2015-5956 | — | >= 6.0, < 6.2.15 | 6.2.15 | Sep 16, 2015 | The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter | ||
| CVE-2014-9509 | — | >= 4.5.0, < 4.5.39 | 4.5.39 | Jan 4, 2015 | The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poison | ||
| CVE-2014-9508 | — | >= 4.5.0, < 4.5.39 | 4.5.39 | Jan 4, 2015 | The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for | ||
| CVE-2014-3946 | — | >= 6.2.0, < 6.2.3 | 6.2.3 | Jun 3, 2014 | The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors. | ||
| CVE-2014-3945 | — | < 6.2.0 | 6.2.0 | Jun 3, 2014 | The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging | ||
| CVE-2014-3944 | — | >= 6.2.0, < 6.2.3 | 6.2.3 | Jun 3, 2014 | The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors. |
- affected >= 8.0.0, < 8.7.27fixed 8.7.27
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
- affected >= 8.0.0, < 8.7.27fixed 8.7.27
TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
- affected >= 9.0.0, < 9.5.8fixed 9.5.8
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is re
- affected >= 8.0.0, < 8.7.25fixed 8.7.25
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
- affected >= 8.0.0, < 8.7.21fixed 8.7.21
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
- affected >= 8.0.0, < 8.7.23fixed 8.7.23
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
- affected < 9.2.0fixed 9.2.0
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
- affected >= 7.6.0, < 7.6.22fixed 7.6.22
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
- affected >= 6.2.0, < 6.2.19fixed 6.2.19
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.
- affected >= 6.2.0, < 6.2.16fixed 6.2.16
The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
- affected >= 6.2.0, < 6.2.16fixed 6.2.16
Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.
- affected >= 6.2.0, < 6.2.16fixed 6.2.16
Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated editors to inject arbitrary web script or HTML via unspecified vectors.
- affected >= 6.2, < 6.2.16fixed 6.2.16
Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
- CVE-2015-5956Sep 16, 2015affected >= 6.0, < 6.2.15fixed 6.2.15
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter
- CVE-2014-9509Jan 4, 2015affected >= 4.5.0, < 4.5.39fixed 4.5.39
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poison
- CVE-2014-9508Jan 4, 2015affected >= 4.5.0, < 4.5.39fixed 4.5.39
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for
- CVE-2014-3946Jun 3, 2014affected >= 6.2.0, < 6.2.3fixed 6.2.3
The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.
- CVE-2014-3945Jun 3, 2014affected < 6.2.0fixed 6.2.0
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging
- CVE-2014-3944Jun 3, 2014affected >= 6.2.0, < 6.2.3fixed 6.2.3
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
Page 4 of 6