typo3/cms (Packagist)
Advisories
453
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 12.2.0 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require typo3/cms:^12.2.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling |
Medium | >= 7.0.0, < 7.6.32 | 7.6.32 |
| GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling |
Medium | >= 9.0.0, < 9.5.2 | 9.5.2 |
| GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling |
Medium | >= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool |
Medium | >= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool |
Medium | >= 9.0.0, < 9.5.2 | 9.5.2 |
| GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool |
Medium | >= 7.0.0, < 7.6.32 | 7.6.32 |
| GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie |
High | >= 9.0.0, < 9.5.2 | 9.5.2 |
| GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie |
High | >= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie |
High | >= 7.0.0, < 7.6.32 | 7.6.32 |
| GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login |
Medium | >= 7.0.0, < 7.6.32 | 7.6.32 |
| GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login |
Medium | >= 9.0.0, < 9.5.2 | 9.5.2 |
| GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login |
Medium | >= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component |
Medium | >= 7.0.0, < 7.6.32 | 7.6.32 |
| GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component |
Medium | >= 9.0.0, < 9.5.2 | 9.5.2 |
| GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component |
Medium | >= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering |
Medium | >= 9.0.0, < 9.5.2 | 9.5.2 |
| GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering |
Medium | >= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering |
Medium | >= 7.0.0, < 7.6.32 | 7.6.32 |
| GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module |
High | >= 8.0.0, < 8.7.23 | 8.7.23 |
| GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module |
High | >= 9.0.0, < 9.5.4 | 9.5.4 |
| GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration |
High | >= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration |
High | >= 7.0.0, < 7.6.32 | 7.6.32 |
| GHSA-f624-8hfq-5fh3 TYPO3 Information Disclosure of Installed Extensions |
Medium | >= 8.0.0, < 8.7.23 | 8.7.23 |
| GHSA-f624-8hfq-5fh3 TYPO3 Information Disclosure of Installed Extensions |
Medium | >= 9.0.0, < 9.5.4 | 9.5.4 |
| GHSA-v8m4-3w37-ghxx TYPO3 Cross-Site Scripting in Form Framework validation handling |
Medium | >= 9.0.0, < 9.5.12 | 9.5.12 |
| GHSA-v8m4-3w37-ghxx TYPO3 Cross-Site Scripting in Form Framework validation handling |
Medium | >= 10.0.0, < 10.2.1 | 10.2.1 |
| GHSA-v8m4-3w37-ghxx TYPO3 Cross-Site Scripting in Form Framework validation handling |
Medium | >= 8.0.0, < 8.7.30 | 8.7.30 |
| GHSA-4h5c-5g25-v7fh TYPO3 Cross-Site Scripting in Form Framework |
Medium | >= 9.0.0, < 9.5.4 | 9.5.4 |
| GHSA-4h5c-5g25-v7fh TYPO3 Cross-Site Scripting in Form Framework |
Medium | >= 8.0.0, < 8.7.23 | 8.7.23 |
| GHSA-c5mj-39cf-3pp5 TYPO3 Security Misconfiguration for Backend User Accounts |
High | >= 8.0.0, < 8.7.23 | 8.7.23 |
| GHSA-c5mj-39cf-3pp5 TYPO3 Security Misconfiguration for Backend User Accounts |
High | >= 9.0.0, < 9.5.4 | 9.5.4 |
| GHSA-xgmx-j3hv-jh9x TYPO3 Cross-Site Scripting in Link Handling |
Medium | >= 8.0.0, < 8.7.30 | 8.7.30 |
| GHSA-xgmx-j3hv-jh9x TYPO3 Cross-Site Scripting in Link Handling |
Medium | >= 10.0.0, < 10.2.1 | 10.2.1 |
| GHSA-xgmx-j3hv-jh9x TYPO3 Cross-Site Scripting in Link Handling |
Medium | >= 9.0.0, < 9.5.12 | 9.5.12 |
| GHSA-772m-43f3-hmf8 TYPO3 Broken Access Control in Localization Handling |
Medium | >= 8.0.0, < 8.7.23 | 8.7.23 |
| GHSA-g7hw-jh4p-75wr TYPO3 Cross-Site Scripting in Filelist Module |
Medium | >= 10.0.0, < 10.2.1 | 10.2.1 |
| GHSA-g7hw-jh4p-75wr TYPO3 Cross-Site Scripting in Filelist Module |
Medium | >= 9.0.0, < 9.5.12 | 9.5.12 |
| GHSA-g7hw-jh4p-75wr TYPO3 Cross-Site Scripting in Filelist Module |
Medium | >= 8.0.0, < 8.7.30 | 8.7.30 |
| GHSA-85ch-44w7-rf32 TYPO3 Cross-Site Scripting in Fluid ViewHelpers |
Medium | >= 9.0.0, < 9.5.4 | 9.5.4 |
| GHSA-85ch-44w7-rf32 TYPO3 Cross-Site Scripting in Fluid ViewHelpers |
Medium | >= 8.0.0, < 8.7.23 | 8.7.23 |
| GHSA-hh95-5xm5-v8v7 TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling |
High | >= 9.0.0, < 9.5.12 | 9.5.12 |
| GHSA-hh95-5xm5-v8v7 TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling |
High | >= 8.0.0, < 8.7.30 | 8.7.30 |
| GHSA-259v-xm34-p7fr Typo3 Cross-Site Scripting in Language Pack Handling |
Medium | >= 9.0.0, < 9.5.4 | 9.5.4 |
| GHSA-f5rr-9r84-wwqf Typo3 Broken Access Control in Import Module |
Medium | >= 9.0.0, < 9.5.8 | 9.5.8 |
| GHSA-h934-f4m4-wc8x Typo3 Information Disclosure in Page Tree |
Low | >= 9.0.0, < 9.5.6 | 9.5.6 |
| GHSA-hww5-6x85-mc24 Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API |
Medium | >= 8.0.0, < 8.7.27 | 8.7.27 |
| GHSA-hww5-6x85-mc24 Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API |
Medium | >= 9.0.0, < 9.5.8 | 9.5.8 |
| GHSA-qr5f-6fcv-w69q Typo3 Security Misconfiguration in Frontend Session Handling |
Medium | >= 9.0.0, < 9.5.8 | 9.5.8 |
| GHSA-qr5f-6fcv-w69q Typo3 Security Misconfiguration in Frontend Session Handling |
Medium | >= 8.0.0, < 8.7.27 | 8.7.27 |
| GHSA-g9rv-6g56-65h8 Typo3 Security Misconfiguration in User Session Handling |
Medium | >= 9.0.0, < 9.5.6 | 9.5.6 |
| GHSA-g9rv-6g56-65h8 Typo3 Security Misconfiguration in User Session Handling |
Medium | >= 8.0.0, < 8.7.25 | 8.7.25 |
| GHSA-q9c4-9v5m-597p Typo3 Information Disclosure in Backend User Interface |
Medium | >= 9.0.0, < 9.5.8 | 9.5.8 |
| GHSA-q9c4-9v5m-597p Typo3 Information Disclosure in Backend User Interface |
Medium | >= 8.0.0, < 8.7.27 | 8.7.27 |
| GHSA-m96r-7vqm-j95g Typo3 Information Disclosure in User Authentication |
Medium | >= 9.0.0, < 9.5.6 | 9.5.6 |
| GHSA-v4qr-8h2v-qpjx Cross-Site Scripting in TYPO3 CMS Backend |
Medium | >= 8.0.0, < 8.7.5 | 8.7.5 |
| GHSA-5gr6-97fv-52cc Cross-Site Scripting in TYPO3 CMS |
Medium | >= 7.6.0, < 7.6.16 | 7.6.16 |
| GHSA-5gr6-97fv-52cc Cross-Site Scripting in TYPO3 CMS |
Medium | >= 8.0.0, < 8.6.1 | 8.6.1 |
| GHSA-c7rj-92xr-wprg Insecure Unserialize in TYPO3 Backend |
Medium | >= 7.6.0, < 7.6.13 | 7.6.13 |
| GHSA-c7rj-92xr-wprg Insecure Unserialize in TYPO3 Backend |
Medium | >= 6.2.0, < 6.2.29 | 6.2.29 |
| GHSA-c7rj-92xr-wprg Insecure Unserialize in TYPO3 Backend |
Medium | >= 8.0.0, < 8.4.1 | 8.4.1 |
| GHSA-pw2q-qwvj-gh43 Cache Flooding in TYPO3 Frontend |
Medium | >= 8.0.0, < 8.3.1 | 8.3.1 |
| GHSA-pw2q-qwvj-gh43 Cache Flooding in TYPO3 Frontend |
Medium | >= 7.6.0, < 7.6.11 | 7.6.11 |
| GHSA-pw2q-qwvj-gh43 Cache Flooding in TYPO3 Frontend |
Medium | >= 6.2.0, < 6.2.27 | 6.2.27 |
| GHSA-mh3r-6cp5-hc2j Authentication Bypass in TYPO3 Frontend |
Medium | >= 8.2.0, < 8.6.1 | 8.6.1 |
| GHSA-6f9m-v7mp-7jjq Authentication Bypass in TYPO3 CMS |
Medium | >= 9.0.0, < 9.3.2 | 9.3.2 |
| GHSA-6f9m-v7mp-7jjq Authentication Bypass in TYPO3 CMS |
Medium | >= 7.0.0, < 7.6.30 | 7.6.30 |
| GHSA-6f9m-v7mp-7jjq Authentication Bypass in TYPO3 CMS |
Medium | >= 8.0.0, < 8.7.17 | 8.7.17 |
| GHSA-g46h-v2cc-6c94 Information Disclosure in TYPO3 CMS |
Medium | >= 8.0.0, < 8.7.5 | 8.7.5 |
| GHSA-g46h-v2cc-6c94 Information Disclosure in TYPO3 CMS |
Medium | >= 7.6.0, < 7.6.22 | 7.6.22 |
| GHSA-ppgf-8745-8pgx Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS |
High | >= 9.0.0, < 9.3.2 | 9.3.2 |
| GHSA-ppgf-8745-8pgx Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS |
High | >= 7.0.0, < 7.6.30 | 7.6.30 |
| GHSA-ppgf-8745-8pgx Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS |
High | >= 8.0.0, < 8.7.17 | 8.7.17 |
| GHSA-c7p6-3c9c-f88q Information Disclosure in TYPO3 CMS |
Low | >= 8.0.0, < 8.7.5 | 8.7.5 |
| GHSA-c7p6-3c9c-f88q Information Disclosure in TYPO3 CMS |
Low | >= 7.6.0, < 7.6.22 | 7.6.22 |
| GHSA-7qwg-fcpw-xg5g Privilege Escalation & SQL Injection in TYPO3 CMS |
High | >= 9.0.0, < 9.3.2 | 9.3.2 |
| GHSA-7qwg-fcpw-xg5g Privilege Escalation & SQL Injection in TYPO3 CMS |
High | >= 8.5.0, < 8.7.17 | 8.7.17 |
| GHSA-g4pf-3jvq-2gcw TYPO3 Remote Code Execution in third party library swiftmailer |
High | >= 6.2.0, < 6.2.30 | 6.2.30 |
| GHSA-g4pf-3jvq-2gcw TYPO3 Remote Code Execution in third party library swiftmailer |
High | >= 8.0.0, < 8.5.1 | 8.5.1 |
| GHSA-g4pf-3jvq-2gcw TYPO3 Remote Code Execution in third party library swiftmailer |
High | >= 7.6.0, < 7.6.15 | 7.6.15 |
| GHSA-67wg-6j7r-mqh8 Arbitrary Code Execution in TYPO3 CMS |
Critical | >= 8.0.0, < 8.7.5 | 8.7.5 |
| GHSA-67wg-6j7r-mqh8 Arbitrary Code Execution in TYPO3 CMS |
Critical | >= 7.6.0, < 7.6.22 | 7.6.22 |
| GHSA-8h28-f46f-m87h Insecure Deserialization in TYPO3 CMS |
High | >= 8.5.0, < 8.7.17 | 8.7.17 |
| GHSA-8h28-f46f-m87h Insecure Deserialization in TYPO3 CMS |
High | >= 9.0.0, < 9.3.2 | 9.3.2 |
| GHSA-p5c5-gmj4-g48f Cross-Site Scripting (XSS) vulnerability in typolinks |
Medium | >= 8.0.0, < 8.2.1 | 8.2.1 |
| GHSA-p5c5-gmj4-g48f Cross-Site Scripting (XSS) vulnerability in typolinks |
Medium | >= 7.6.0, < 7.6.10 | 7.6.10 |
| GHSA-p5c5-gmj4-g48f Cross-Site Scripting (XSS) vulnerability in typolinks |
Medium | >= 6.2.0, < 6.2.26 | 6.2.26 |
| GHSA-hq37-rfjc-mr8h Cross-Site Scripting (XSS) in TYPO3 Backend |
Medium | >= 6.2.0, < 6.2.27 | 6.2.27 |
| GHSA-hq37-rfjc-mr8h Cross-Site Scripting (XSS) in TYPO3 Backend |
Medium | >= 8.0.0, < 8.3.1 | 8.3.1 |
| GHSA-hq37-rfjc-mr8h Cross-Site Scripting (XSS) in TYPO3 Backend |
Medium | >= 7.6.0, < 7.6.11 | 7.6.11 |
| GHSA-qmwf-j7g7-f5jw Cross-Site Scripting in third party library mso/idna-convert |
Medium | >= 8.0.0, < 8.2.1 | 8.2.1 |
| GHSA-qmwf-j7g7-f5jw Cross-Site Scripting in third party library mso/idna-convert |
Medium | >= 7.6.0, < 7.6.10 | 7.6.10 |
| GHSA-vpr3-rc99-2wpr Information Disclosure in TYPO3 Backend |
Medium | >= 8.0.0, < 8.2.1 | 8.2.1 |
| GHSA-vpr3-rc99-2wpr Information Disclosure in TYPO3 Backend |
Medium | >= 7.6.0, < 7.6.10 | 7.6.10 |
| GHSA-vpr3-rc99-2wpr Information Disclosure in TYPO3 Backend |
Medium | >= 6.2.0, < 6.2.26 | 6.2.26 |
| GHSA-j86x-pjmr-9m6w SQL Injection in TYPO3 Frontend Login |
Medium | >= 6.2.0, < 6.2.26 | 6.2.26 |
| GHSA-j86x-pjmr-9m6w SQL Injection in TYPO3 Frontend Login |
Medium | >= 7.6.0, < 7.6.10 | 7.6.10 |
| GHSA-gwfx-p7mr-f92v Missing Access Check in TYPO3 CMS |
Critical | >= 6.2.0, < 6.2.25 | 6.2.25 |
| GHSA-gwfx-p7mr-f92v Missing Access Check in TYPO3 CMS |
Critical | >= 8.0.0, < 8.1.1 | 8.1.1 |
| GHSA-gwfx-p7mr-f92v Missing Access Check in TYPO3 CMS |
Critical | >= 7.6.0, < 7.6.8 | 7.6.8 |
| GHSA-xvcp-33rc-j8gq Insecure Unserialize in TYPO3 Import/Export |
Medium | >= 7.6.0, < 7.6.10 | 7.6.10 |
| GHSA-xvcp-33rc-j8gq Insecure Unserialize in TYPO3 Import/Export |
Medium | >= 6.2.0, < 6.2.26 | 6.2.26 |
| GHSA-xvcp-33rc-j8gq Insecure Unserialize in TYPO3 Import/Export |
Medium | >= 8.0.0, < 8.2.1 | 8.2.1 |
| GHSA-86r8-4g3w-7xjp Cross-Site Scripting in TYPO3 Backend |
Medium | >= 7.6.0, < 7.6.10 | 7.6.10 |
| GHSA-86r8-4g3w-7xjp Cross-Site Scripting in TYPO3 Backend |
Medium | >= 8.0.0, < 8.2.1 | 8.2.1 |
| GHSA-86r8-4g3w-7xjp Cross-Site Scripting in TYPO3 Backend |
Medium | >= 6.2.0, < 6.2.26 | 6.2.26 |
| GHSA-v5jp-4h2p-j2p4 Privilege Escalation in TYPO3 CMS |
Medium | >= 6.2.0, < 6.2.20 | 6.2.20 |
| GHSA-v5jp-4h2p-j2p4 Privilege Escalation in TYPO3 CMS |
Medium | >= 8.0.0, < 8.0.1 | 8.0.1 |
| GHSA-v5jp-4h2p-j2p4 Privilege Escalation in TYPO3 CMS |
Medium | >= 7.6.0, < 7.6.5 | 7.6.5 |
| GHSA-5wx6-xwxf-q8qj Cross-Site Scripting in TYPO3 Backend |
Medium | >= 8.0.0, < 8.0.1 | 8.0.1 |
| GHSA-5wx6-xwxf-q8qj Cross-Site Scripting in TYPO3 Backend |
Medium | >= 6.2.0, < 6.2.20 | 6.2.20 |
| GHSA-5wx6-xwxf-q8qj Cross-Site Scripting in TYPO3 Backend |
Medium | >= 7.6.0, < 7.6.5 | 7.6.5 |
| GHSA-6xh8-8pfv-53vx Authentication Bypass in TYPO3 CMS |
Medium | >= 7.6.0, < 7.6.5 | 7.6.5 |
| GHSA-6xh8-8pfv-53vx Authentication Bypass in TYPO3 CMS |
Medium | >= 8.0.0, < 8.0.1 | 8.0.1 |
| GHSA-6xh8-8pfv-53vx Authentication Bypass in TYPO3 CMS |
Medium | >= 6.2.0, < 6.2.20 | 6.2.20 |
| GHSA-pmxp-7224-h794 Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search |
Medium | >= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-pmxp-7224-h794 Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search |
Medium | >= 7.6.0, < 7.6.4 | 7.6.4 |
| GHSA-wrpf-2x8h-82gr Typo3 Arbitrary File Disclosure in Form Component |
Medium | >= 6.2.0, < 6.2.20 | 6.2.20 |
| GHSA-8j9v-4hhh-x43c Cross-Site Scripting (XSS) in TYPO3 component CSS styled content |
Medium | >= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-8j9v-4hhh-x43c Cross-Site Scripting (XSS) in TYPO3 component CSS styled content |
Medium | >= 7.6.0, < 7.6.4 | 7.6.4 |
| GHSA-qffc-gwpp-m2xr XML External Entity (XXE) Processing in TYPO3 Core |
High | >= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-qffc-gwpp-m2xr XML External Entity (XXE) Processing in TYPO3 Core |
High | >= 7.6.0, < 7.6.4 | 7.6.4 |
| GHSA-3jxq-5xhh-9jr3 Cross-Site Scripting (XSS) in TYPO3 component Backend |
Medium | >= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-5j86-5xvg-7q93 TYPO3 Cross-Site Scripting (XSS) in form component |
Medium | >= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-vgm8-r9gm-fw59 TYPO3 Cross-Site Scripting in legacy form component |
Medium | >= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-cg4m-qjjp-7497 TYPO3 Cross-Site Scripting in link validator component |
Medium | >= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-cg4m-qjjp-7497 TYPO3 Cross-Site Scripting in link validator component |
Medium | >= 7.6.0, < 7.6.3 | 7.6.3 |
| GHSA-6fc6-cj2j-h22x TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend |
Medium | >= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-6fc6-cj2j-h22x TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend |
Medium | >= 7.0.0, < 7.6.1 | 7.6.1 |
| GHSA-9895-53fc-98v2 TYPO3 SQL Injection in dbal |
High | >= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-wh8q-72cp-p5wf Cross-Site Scripting in TYPO3 component Indexed Search |
Medium | >= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-qrxh-46mr-pr7q TYPO3 is susceptible to Cross-Site Flashing |
Medium | >= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-5cxf-xx9j-54jc Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend |
Medium | >= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-5cxf-xx9j-54jc Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend |
Medium | >= 7.0.0, < 7.6.1 | 7.6.1 |
| GHSA-75mx-chcf-2q32 Duplicate Advisory: TYPO3 Cross-Site Scripting vulnerability in typolinks Withdrawn |
Medium | >= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-75mx-chcf-2q32 Duplicate Advisory: TYPO3 Cross-Site Scripting vulnerability in typolinks Withdrawn |
Medium | >= 7.0.0, < 7.6.1 | 7.6.1 |
| GHSA-pqfv-97hj-g97g TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure |
Medium | >= 7.0.0, < 7.4.0 | 7.4.0 |
| GHSA-pqfv-97hj-g97g TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure |
Medium | >= 6.2.0, < 6.2.15 | 6.2.15 |
| GHSA-jqr8-q455-xx45 TYPO3 Brute Force Protection Bypass in backend login |
Medium | >= 7.0.0, < 7.3.1 | 7.3.1 |
| GHSA-jqr8-q455-xx45 TYPO3 Brute Force Protection Bypass in backend login |
Medium | >= 6.2.0, < 6.2.14 | 6.2.14 |
| GHSA-r287-hc8j-w56h TYPO3 Information Disclosure Vulnerability Exploitable by Editors |
Medium | >= 6.2.0, < 6.2.14 | 6.2.14 |
| GHSA-r287-hc8j-w56h TYPO3 Information Disclosure Vulnerability Exploitable by Editors |
Medium | >= 7.0.0, < 7.3.1 | 7.3.1 |
| GHSA-wp8j-c736-c5r3 TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors |
Medium | >= 6.2.0, < 6.2.14 | 6.2.14 |
| GHSA-wp8j-c736-c5r3 TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors |
Medium | >= 7.0.0, < 7.3.1 | 7.3.1 |
| GHSA-r9vc-jfmh-6j48 TYPO3 frontend login vulnerable to Session Fixation |
High | >= 6.2.0, < 6.2.14 | 6.2.14 |
| GHSA-r9vc-jfmh-6j48 TYPO3 frontend login vulnerable to Session Fixation |
High | >= 7.0.0, < 7.3.1 | 7.3.1 |
| GHSA-4r76-xr68-w7m7 TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts |
High | >= 7.0.0, < 7.3.1 | 7.3.1 |
| GHSA-4r76-xr68-w7m7 TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts |
High | >= 6.2.0, < 6.2.14 | 6.2.14 |
| GHSA-p84g-j2gh-83g3 TYPO3 possible cache poisoning on the homepage when anchors are used |
High | >= 7.0.0, < 7.0.2 | 7.0.2 |
| GHSA-p84g-j2gh-83g3 TYPO3 possible cache poisoning on the homepage when anchors are used |
High | >= 6.2.0, < 6.2.9 | 6.2.9 |
| GHSA-mxjf-hc9v-xgv2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting |
Medium | >= 4.5.0, < 4.5.34 | 4.5.34 |
| GHSA-mxjf-hc9v-xgv2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting |
Medium | >= 4.7.0, < 4.7.19 | 4.7.19 |
| GHSA-mxjf-hc9v-xgv2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting |
Medium | >= 6.1.0, < 6.1.9 | 6.1.9 |
| GHSA-mxjf-hc9v-xgv2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting |
Medium | >= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-45xg-4w5x-j429 TYPO3 Arbitrary Shell Execution in Swiftmailer library |
High | >= 4.7.0, < 4.7.20 | 4.7.20 |
| GHSA-45xg-4w5x-j429 TYPO3 Arbitrary Shell Execution in Swiftmailer library |
High | >= 6.2.0, < 6.2.6 | 6.2.6 |
| GHSA-45xg-4w5x-j429 TYPO3 Arbitrary Shell Execution in Swiftmailer library |
High | >= 6.1.0, < 6.1.12 | 6.1.12 |
| GHSA-45xg-4w5x-j429 TYPO3 Arbitrary Shell Execution in Swiftmailer library |
High | >= 4.5.0, < 4.5.37 | 4.5.37 |
| GHSA-gj48-w74w-8gvm Path Traversal in TYPO3 Core |
Medium | >= 8.0.0, < 8.4.1 | 8.4.1 |
| GHSA-gj48-w74w-8gvm Path Traversal in TYPO3 Core |
Medium | >= 7.6.0, < 7.6.13 | 7.6.13 |
| GHSA-gj48-w74w-8gvm Path Traversal in TYPO3 Core |
Medium | >= 6.2.0, < 6.2.29 | 6.2.29 |
| GHSA-r4f8-f93x-5qh3 TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering |
Medium EPSS 0.83% |
>= 10.0.0, < 10.4.35 | 10.4.35 |
| GHSA-r4f8-f93x-5qh3 TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering |
Medium EPSS 0.83% |
>= 12.0.0, < 12.2.0 | 12.2.0 |
| GHSA-r4f8-f93x-5qh3 TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering |
Medium EPSS 0.83% |
>= 11.0.0, < 11.5.23 | 11.5.23 |
| GHSA-53mm-hx32-6475 TYPO3 vulnerable to Insufficient Session Expiration |
Critical EPSS 0.47% |
< 2.0.5 | 2.0.5 |
| GHSA-53mm-hx32-6475 TYPO3 vulnerable to Insufficient Session Expiration |
Critical EPSS 0.47% |
>= 3.0.0, < 3.0.3 | 3.0.3 |
| GHSA-8w3p-qh3x-6gjr TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration |
Medium EPSS 0.55% |
>= 11.0.0, < 11.5.20 | 11.5.20 |
| GHSA-8w3p-qh3x-6gjr TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration |
Medium EPSS 0.55% |
>= 10.0.0, < 10.4.33 | 10.4.33 |
| GHSA-8w3p-qh3x-6gjr TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration |
Medium EPSS 0.55% |
>= 12.0.0, < 12.1.1 | 12.1.1 |
| GHSA-c5wx-6c2c-f7rm TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework |
High EPSS 0.84% |
>= 10.0.0, < 10.4.33 | 10.4.33 |
| GHSA-c5wx-6c2c-f7rm TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework |
High EPSS 0.84% |
>= 12.0.0, < 12.1.1 | 12.1.1 |
| GHSA-c5wx-6c2c-f7rm TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework |
High EPSS 0.84% |
>= 11.0.0, < 11.5.20 | 11.5.20 |
| GHSA-mgj2-q8wp-29rr TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset |
Medium EPSS 0.43% |
>= 12.0.0, < 12.1.1 | 12.1.1 |
| GHSA-mgj2-q8wp-29rr TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset |
Medium EPSS 0.43% |
>= 10.0.0, < 10.4.33 | 10.4.33 |
| GHSA-mgj2-q8wp-29rr TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset |
Medium EPSS 0.43% |
>= 11.0.0, < 11.5.20 | 11.5.20 |
| GHSA-jfp7-79g7-89rf TYPO3 CMS vulnerable to Weak Authentication in Frontend Login |
Medium EPSS 0.51% |
>= 11.0.0, < 11.5.20 | 11.5.20 |
| GHSA-jfp7-79g7-89rf TYPO3 CMS vulnerable to Weak Authentication in Frontend Login |
Medium EPSS 0.51% |
>= 10.0.0, < 10.4.33 | 10.4.33 |
| GHSA-jfp7-79g7-89rf TYPO3 CMS vulnerable to Weak Authentication in Frontend Login |
Medium EPSS 0.51% |
>= 12.0.0, < 12.1.1 | 12.1.1 |
| GHSA-8c28-5mp7-v24h TYPO3 CMS vulnerable to Denial of Service in Page Error Handling |
Medium EPSS 0.73% |
>= 11.0.0, < 11.5.20 | 11.5.20 |
| GHSA-8c28-5mp7-v24h TYPO3 CMS vulnerable to Denial of Service in Page Error Handling |
Medium EPSS 0.73% |
>= 10.0.0, < 10.4.33 | 10.4.33 |
| GHSA-hvwx-qh2h-xcfj TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting |
Medium EPSS 0.47% |
>= 10.0.0, < 10.4.33 | 10.4.33 |
| GHSA-hvwx-qh2h-xcfj TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting |
Medium EPSS 0.47% |
>= 11.0.0, < 11.5.20 | 11.5.20 |
| GHSA-hvwx-qh2h-xcfj TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting |
Medium EPSS 0.47% |
>= 12.0.0, < 12.1.1 | 12.1.1 |
| GHSA-47m6-46mj-p235 TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection |
Medium EPSS 0.82% |
>= 10.0.0, < 10.4.32 | 10.4.32 |
| GHSA-47m6-46mj-p235 TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection |
Medium EPSS 0.82% |
>= 11.0.0, < 11.5.16 | 11.5.16 |
| GHSA-fffr-7x4x-f98q TYPO3 CMS vulnerable to Denial of Service in Page Error Handling |
Medium EPSS 1.61% |
>= 11.4.0, < 11.5.16 | 11.5.16 |
| GHSA-m392-235j-9r7r TYPO3 CMS vulnerable to User Enumeration via Response Timing |
Medium EPSS 1.26% |
>= 10.0.0, < 10.4.32 | 10.4.32 |
| GHSA-m392-235j-9r7r TYPO3 CMS vulnerable to User Enumeration via Response Timing |
Medium EPSS 1.26% |
>= 11.0.0, < 11.5.16 | 11.5.16 |
| GHSA-5959-4x58-r8c2 TYPO3 CMS missing check for expiration time of password reset token for backend users |
Medium EPSS 0.95% |
>= 11.0.0, < 11.5.16 | 11.5.16 |
| GHSA-5959-4x58-r8c2 TYPO3 CMS missing check for expiration time of password reset token for backend users |
Medium EPSS 0.95% |
>= 10.4.0, < 10.4.32 | 10.4.32 |
| GHSA-9c6w-55cp-5w25 TYPO3 CMS Stored Cross-Site Scripting via FileDumpController |
Medium EPSS 0.93% |
>= 11.0.0, < 11.5.16 | 11.5.16 |
| GHSA-9c6w-55cp-5w25 TYPO3 CMS Stored Cross-Site Scripting via FileDumpController |
Medium EPSS 0.93% |
>= 10.0.0, < 10.4.32 | 10.4.32 |
| GHSA-fv2m-9249-qx85 TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper |
Medium EPSS 0.93% |
>= 11.0.0, < 11.5.16 | 11.5.16 |
| GHSA-fv2m-9249-qx85 TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper |
Medium EPSS 0.93% |
>= 10.3.0, < 10.4.32 | 10.4.32 |
| GHSA-wwjw-r3gj-39fq Insufficient Session Expiration in TYPO3's Admin Tool |
Medium EPSS 1.26% |
>= 10.0.0, < 10.4.29 | 10.4.29 |
| GHSA-wwjw-r3gj-39fq Insufficient Session Expiration in TYPO3's Admin Tool |
Medium EPSS 1.26% |
>= 11.0.0, < 11.5.11 | 11.5.11 |
| GHSA-h4mx-xv96-2jgm Cross-Site Scripting in TYPO3's Frontend Login Mailer |
Medium EPSS 0.77% |
>= 11.0.0, < 11.5.11 | 11.5.11 |
| GHSA-h4mx-xv96-2jgm Cross-Site Scripting in TYPO3's Frontend Login Mailer |
Medium EPSS 0.77% |
>= 10.0.0, < 10.4.29 | 10.4.29 |
| GHSA-3r95-23jp-mhvg Cross-Site Scripting in TYPO3's Form Framework |
Medium EPSS 0.77% |
>= 11.0.0, < 11.5.11 | 11.5.11 |
| GHSA-3r95-23jp-mhvg Cross-Site Scripting in TYPO3's Form Framework |
Medium EPSS 0.77% |
>= 10.0.0, < 10.4.29 | 10.4.29 |
| GHSA-fh99-4pgr-8j99 Insertion of Sensitive Information into Log File in typo3/cms-core |
Medium EPSS 1.13% |
>= 10.0.0, < 10.4.29 | 10.4.29 |
| GHSA-fh99-4pgr-8j99 Insertion of Sensitive Information into Log File in typo3/cms-core |
Medium EPSS 1.13% |
>= 11.0.0, < 11.5.11 | 11.5.11 |
| GHSA-8gmv-9hwg-w89g Information Disclosure via Export Module |
Medium EPSS 0.63% |
>= 11.0.0, < 11.5.11 | 11.5.11 |
| GHSA-8gmv-9hwg-w89g Information Disclosure via Export Module |
Medium EPSS 0.63% |
>= 10.0.0, < 10.4.29 | 10.4.29 |
| GHSA-r6fv-56gp-j3r4 Typo3 Cross-Site Scripting in Link Handling |
Medium EPSS 0.69% |
>= 8.0.0, < 8.7.27 | 8.7.27 |
| GHSA-86hp-xrhj-fhpq TYPO3 Vulnerable to Insecure Deserialization |
High EPSS 1.53% |
>= 8.0.0, < 8.7.27 | 8.7.27 |
| GHSA-86hp-xrhj-fhpq TYPO3 Vulnerable to Insecure Deserialization |
High EPSS 1.53% |
>= 9.0.0, < 9.5.8 | 9.5.8 |
| GHSA-r6fv-56gp-j3r4 Typo3 Cross-Site Scripting in Link Handling |
Medium EPSS 0.69% |
>= 9.0.0, < 9.5.8 | 9.5.8 |
| GHSA-3w4h-r27h-4r2w TYPO3 Image Processing susceptible to Code Execution |
High EPSS 3.92% |
>= 8.0.0, < 8.7.25 | 8.7.25 |
| GHSA-3w4h-r27h-4r2w TYPO3 Image Processing susceptible to Code Execution |
High EPSS 3.92% |
>= 9.0.0, < 9.5.6 | 9.5.6 |
| GHSA-qvhv-pwww-53jj Typo3 Cross-Site Scripting in Flash component (ELTS) |
Medium EPSS 5.21% |
>= 6.2.0, < 6.2.39 | 6.2.39 |
| GHSA-qvhv-pwww-53jj Typo3 Cross-Site Scripting in Flash component (ELTS) |
Medium EPSS 5.21% |
>= 7.0.0, < 7.2.0 | 7.2.0 |
| GHSA-59pj-7mjh-4465 TYPO3 SQL Injection in low-level Query Generator |
Medium EPSS 0.87% |
>= 8.0, < 8.7.30 | 8.7.30 |
| GHSA-59pj-7mjh-4465 TYPO3 SQL Injection in low-level Query Generator |
Medium EPSS 0.87% |
>= 10.0, < 10.2.2 | 10.2.2 |
| GHSA-59pj-7mjh-4465 TYPO3 SQL Injection in low-level Query Generator |
Medium EPSS 0.87% |
>= 9.0, < 9.5.12 | 9.5.12 |
| GHSA-77p4-wfr8-977w TYPO3 Directory Traversal on ZIP extraction |
Medium EPSS 1.45% |
>= 8.0.0, < 8.7.30 | 8.7.30 |
| GHSA-77p4-wfr8-977w TYPO3 Directory Traversal on ZIP extraction |
Medium EPSS 1.45% |
>= 9.0.0, < 9.5.12 | 9.5.12 |
| GHSA-rcgc-4xfc-564v TYPO3 Insecure Deserialization in Query Generator & Query View |
High EPSS 1.27% |
>= 9.0.0, < 9.5.12 | 9.5.12 |
| GHSA-rcgc-4xfc-564v TYPO3 Insecure Deserialization in Query Generator & Query View |
High EPSS 1.27% |
>= 8.0.0, < 8.7.30 | 8.7.30 |
| GHSA-77p4-wfr8-977w TYPO3 Directory Traversal on ZIP extraction |
Medium EPSS 1.45% |
>= 10.0.0, < 10.2.2 | 10.2.2 |
| GHSA-rcgc-4xfc-564v TYPO3 Insecure Deserialization in Query Generator & Query View |
High EPSS 1.27% |
>= 10.0.0, < 10.2.1 | 10.2.1 |
| GHSA-w736-qv86-vq94 TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism |
High EPSS 24.13% |
>= 4.4.0, < 4.4.4 | 4.4.4 |
| GHSA-w736-qv86-vq94 TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism |
High EPSS 24.13% |
>= 4.2.0, < 4.2.15 | 4.2.15 |
| GHSA-w736-qv86-vq94 TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism |
High EPSS 24.13% |
>= 4.3.0, < 4.3.7 | 4.3.7 |
| GHSA-q68v-vcjg-r3vp TYPO3 allows remote attackers to obtain the database name via a direct request |
Medium EPSS 3.09% |
>= 4.6.0, <= 4.6.6 | No fix yet |
| GHSA-7wwr-p84q-qr3q Typo3 Backend XSS Vulnerabilities |
Low EPSS 1.61% |
>= 4.5.0, < 4.5.14 | 4.5.14 |
| GHSA-7wwr-p84q-qr3q Typo3 Backend XSS Vulnerabilities |
Low EPSS 1.61% |
>= 4.4.0, < 4.4.14 | 4.4.14 |
| GHSA-w3v6-r62r-fvqh Typo3 API XSS Vulnerabilities |
Medium EPSS 2.30% |
>= 4.5.0, < 4.5.14 | 4.5.14 |
| GHSA-w3v6-r62r-fvqh Typo3 API XSS Vulnerabilities |
Medium EPSS 2.30% |
>= 4.4.0, < 4.4.14 | 4.4.14 |
| GHSA-q68v-vcjg-r3vp TYPO3 allows remote attackers to obtain the database name via a direct request |
Medium EPSS 3.09% |
>= 4.4.0, <= 4.4.13 | No fix yet |
| GHSA-q68v-vcjg-r3vp TYPO3 allows remote attackers to obtain the database name via a direct request |
Medium EPSS 3.09% |
>= 4.5.0, <= 4.5.13 | No fix yet |
| GHSA-w3v6-r62r-fvqh Typo3 API XSS Vulnerabilities |
Medium EPSS 2.30% |
>= 4.6.0, < 4.6.7 | 4.6.7 |
| GHSA-7wwr-p84q-qr3q Typo3 Backend XSS Vulnerabilities |
Low EPSS 1.61% |
>= 4.6.0, < 4.6.7 | 4.6.7 |
| GHSA-7jfm-px59-99w8 Typo3 Extbase Framework Unsafe Deserialization |
Medium EPSS 2.37% |
>= 4.6, < 4.6.7 | 4.6.7 |
| GHSA-7jfm-px59-99w8 Typo3 Extbase Framework Unsafe Deserialization |
Medium EPSS 2.37% |
>= 4.5.0, < 4.5.14 | 4.5.14 |
| GHSA-7jfm-px59-99w8 Typo3 Extbase Framework Unsafe Deserialization |
Medium EPSS 2.37% |
>= 4.4.0, < 4.4.14 | 4.4.14 |
| GHSA-47ww-mq32-g4xw TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component |
Medium EPSS 1.27% |
>= 6.0.0, < 6.0.12 | 6.0.12 |
| GHSA-47ww-mq32-g4xw TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component |
Medium EPSS 1.27% |
>= 4.7.0, < 4.7.17 | 4.7.17 |
| GHSA-47ww-mq32-g4xw TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component |
Medium EPSS 1.27% |
>= 6.1.0, < 6.1.7 | 6.1.7 |
| GHSA-47ww-mq32-g4xw TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component |
Medium EPSS 1.27% |
>= 4.5.0, < 4.5.32 | 4.5.32 |
| GHSA-m76j-69c2-c3m8 TYPO3 vulnerable to remote authenticated arbitrary code execution |
High EPSS 1.12% |
>= 6.1.0, < 6.1.4 | 6.1.4 |
| GHSA-2hp4-8h6h-93rr Typo3 Backend History Module Vulnerable to XSS |
Medium EPSS 0.99% |
>= 4.7, < 4.7.6 | 4.7.6 |
| GHSA-2hp4-8h6h-93rr Typo3 Backend History Module Vulnerable to XSS |
Medium EPSS 0.99% |
>= 4.5, < 4.5.21 | 4.5.21 |
| GHSA-2hp4-8h6h-93rr Typo3 Backend History Module Vulnerable to XSS |
Medium EPSS 0.99% |
>= 4.6, < 4.6.14 | 4.6.14 |
| GHSA-m76j-69c2-c3m8 TYPO3 vulnerable to remote authenticated arbitrary code execution |
High EPSS 1.12% |
>= 6.0.0, < 6.0.9 | 6.0.9 |
| GHSA-54jj-pxx2-pv8h TYPO3 doesn't properly check file extensions |
High EPSS 1.15% |
>= 6.0.0, < 6.0.8 | 6.0.8 |
| GHSA-54jj-pxx2-pv8h TYPO3 doesn't properly check file extensions |
High EPSS 1.15% |
>= 6.1.0, < 6.1.3 | 6.1.3 |
| GHSA-h7wf-jg4f-x2wc TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash |
Critical EPSS 1.64% |
< 6.2.0 | 6.2.0 |
| GHSA-9j8h-xrgj-7gw2 TYPO3 Improper Session Invalidation |
Medium EPSS 1.31% |
>= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-vccp-5v5h-p8m6 Typo3 Information Disclosure |
Medium EPSS 1.12% |
>= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning |
High EPSS 1.50% |
>= 6.2.0, < 6.2.9 | 6.2.9 |
| GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning |
High EPSS 1.50% |
>= 7.0.0, < 7.0.2 | 7.0.2 |
| GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning |
High EPSS 1.50% |
>= 4.6.0, < 4.6.19 | 4.6.19 |
| GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning |
High EPSS 1.50% |
>= 4.7.0, < 4.7.21 | 4.7.21 |
| GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning |
High EPSS 1.50% |
>= 6.0.0, < 6.0.15 | 6.0.15 |
| GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning |
High EPSS 1.50% |
>= 6.1.0, < 6.1.13 | 6.1.13 |
| GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning |
High EPSS 1.50% |
>= 4.5.0, < 4.5.39 | 4.5.39 |
| GHSA-j5v7-9xr5-m7gx TYPO3 Cross-site Scripting vulnerability |
Medium EPSS 0.64% |
>= 7.0.0, < 7.6.1 | 7.6.1 |
| GHSA-xx7m-8rq2-cw2v TYPO3 CMS indexed search Cross-site Scripting vulnerability |
Medium EPSS 0.80% |
>= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-j5v7-9xr5-m7gx TYPO3 Cross-site Scripting vulnerability |
Medium EPSS 0.64% |
>= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-56f9-5563-m2h7 Typo3 XSS Vulnerability |
Medium EPSS 1.14% |
>= 7.0, < 7.6.1 | 7.6.1 |
| GHSA-56f9-5563-m2h7 Typo3 XSS Vulnerability |
Medium EPSS 1.14% |
>= 6.2, < 6.2.16 | 6.2.16 |
| GHSA-3f58-74qw-ph75 TYPO3 allows remote attackers to embed Flash videos from external domain |
Medium EPSS 1.43% |
>= 6.2.0, < 6.2.16 | 6.2.16 |
| GHSA-5qp6-78pr-gv8c PHP OpenID Library Denial of Service vulnerability |
High EPSS 3.00% |
>= 6.2.0, < 6.2.6 | 6.2.6 |
| GHSA-4rpv-g4gq-rh4m TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component |
Medium EPSS 1.26% |
>= 6.1.0, < 6.1.7 | 6.1.7 |
| GHSA-4rpv-g4gq-rh4m TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component |
Medium EPSS 1.26% |
>= 6.0.0, < 6.0.12 | 6.0.12 |
| GHSA-4rpv-g4gq-rh4m TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component |
Medium EPSS 1.26% |
>= 4.5.0, < 4.5.32 | 4.5.32 |
| GHSA-4rpv-g4gq-rh4m TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component |
Medium EPSS 1.26% |
>= 4.7.0, < 4.7.17 | 4.7.17 |
| GHSA-v6xv-rmqc-wcc8 Typo3 Open Redirect In Frontend Rendering |
Medium EPSS 1.72% |
>= 4.5.0, < 4.5.39 | 4.5.39 |
| GHSA-v6xv-rmqc-wcc8 Typo3 Open Redirect In Frontend Rendering |
Medium EPSS 1.72% |
>= 7.0.0, < 7.0.2 | 7.0.2 |
| GHSA-v6xv-rmqc-wcc8 Typo3 Open Redirect In Frontend Rendering |
Medium EPSS 1.72% |
>= 4.6.0, < 6.2.9 | 6.2.9 |
| GHSA-ffcm-vhcw-p32r TYPO3 Backend component Cross-site scripting (XSS) vulnerability |
Medium EPSS 1.08% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-66j3-66cp-6c2m TYPO3 Path Traversal vulnerability |
Medium EPSS 3.08% |
>= 4.3.0, < 4.3.9 | 4.3.9 |
| GHSA-66j3-66cp-6c2m TYPO3 Path Traversal vulnerability |
Medium EPSS 3.08% |
>= 4.4.0, < 4.4.5 | 4.4.5 |
| GHSA-rmqc-wfjm-3f66 TYPO3 Directory Traversal vulnerability |
Medium EPSS 1.90% |
>= 4.3.0, < 4.3.9 | 4.3.9 |
| GHSA-rmqc-wfjm-3f66 TYPO3 Directory Traversal vulnerability |
Medium EPSS 1.90% |
>= 4.2.0, < 4.2.16 | 4.2.16 |
| GHSA-rmqc-wfjm-3f66 TYPO3 Directory Traversal vulnerability |
Medium EPSS 1.90% |
>= 4.4.0, < 4.4.5 | 4.4.5 |
| GHSA-66j3-66cp-6c2m TYPO3 Path Traversal vulnerability |
Medium EPSS 3.08% |
>= 4.2.0, < 4.2.16 | 4.2.16 |
| GHSA-r2w2-2r2x-fpcx TYPO3 SQL Injection vulnerability |
Medium EPSS 1.31% |
>= 4.2.0, < 4.2.16 | 4.2.16 |
| GHSA-r2w2-2r2x-fpcx TYPO3 SQL Injection vulnerability |
Medium EPSS 1.31% |
>= 4.4.0, < 4.4.5 | 4.4.5 |
| GHSA-r2w2-2r2x-fpcx TYPO3 SQL Injection vulnerability |
Medium EPSS 1.31% |
>= 4.3.0, < 4.3.9 | 4.3.9 |
| GHSA-qfr3-29w6-hwpg Typo3 Exception Handler XSS |
Medium EPSS 1.39% |
>= 4.5, < 4.5.15 | 4.5.15 |
| GHSA-qfr3-29w6-hwpg Typo3 Exception Handler XSS |
Medium EPSS 1.39% |
>= 4.4, < 4.4.15 | 4.4.15 |
| GHSA-qfr3-29w6-hwpg Typo3 Exception Handler XSS |
Medium EPSS 1.39% |
>= 4.6, < 4.6.8 | 4.6.8 |
| GHSA-qfr3-29w6-hwpg Typo3 Exception Handler XSS |
Medium EPSS 1.39% |
No fix yet | |
| GHSA-m4hw-r893-xh4g TYPO3 allows remote authenticated backend users to unserialize arbitrary objects |
Medium EPSS 2.12% |
>= 4.5.0, < 4.5.19 | 4.5.19 |
| GHSA-m4hw-r893-xh4g TYPO3 allows remote authenticated backend users to unserialize arbitrary objects |
Medium EPSS 2.12% |
>= 4.7.0, < 4.7.4 | 4.7.4 |
| GHSA-m4hw-r893-xh4g TYPO3 allows remote authenticated backend users to unserialize arbitrary objects |
Medium EPSS 2.12% |
>= 4.6.0, < 4.6.12 | 4.6.12 |
| GHSA-7w6c-5pr4-7qvp Typo3 Backend XSS Vulnerability |
Low EPSS 2.03% |
>= 4.6, < 4.6.12 | 4.6.12 |
| GHSA-7w6c-5pr4-7qvp Typo3 Backend XSS Vulnerability |
Low EPSS 2.03% |
>= 4.7, < 4.7.4 | 4.7.4 |
| GHSA-7w6c-5pr4-7qvp Typo3 Backend XSS Vulnerability |
Low EPSS 2.03% |
>= 4.5, < 4.5.19 | 4.5.19 |
| GHSA-7gg8-3r6j-5g55 Typo3 Backend Configuration XSS Vulnerability |
Low EPSS 0.84% |
>= 4.5, < 4.5.19 | 4.5.19 |
| GHSA-7gg8-3r6j-5g55 Typo3 Backend Configuration XSS Vulnerability |
Low EPSS 0.84% |
>= 4.6, < 4.6.12 | 4.6.12 |
| GHSA-7gg8-3r6j-5g55 Typo3 Backend Configuration XSS Vulnerability |
Low EPSS 0.84% |
>= 4.7, < 4.7.4 | 4.7.4 |
| GHSA-94c2-g68f-9r98 Typo3 API XSS Vulnerability |
Medium EPSS 1.65% |
>= 4.7, < 4.7.4 | 4.7.4 |
| GHSA-94c2-g68f-9r98 Typo3 API XSS Vulnerability |
Medium EPSS 1.65% |
>= 4.6, < 4.6.12 | 4.6.12 |
| GHSA-94c2-g68f-9r98 Typo3 API XSS Vulnerability |
Medium EPSS 1.65% |
>= 4.5, < 4.5.19 | 4.5.19 |
| GHSA-p9wg-jvj4-cx26 Typo3 Install Tool XSS Vulnerability |
Medium EPSS 1.49% |
>= 4.6, < 4.6.12 | 4.6.12 |
| GHSA-p9wg-jvj4-cx26 Typo3 Install Tool XSS Vulnerability |
Medium EPSS 1.49% |
>= 4.5, < 4.5.19 | 4.5.19 |
| GHSA-p9wg-jvj4-cx26 Typo3 Install Tool XSS Vulnerability |
Medium EPSS 1.49% |
>= 4.7, < 4.7.4 | 4.7.4 |
| GHSA-rgf6-9q7g-55qg Typo3 Function Menu API XSS Vulnerability |
Low EPSS 1.18% |
>= 4.6.0, < 4.6.14 | 4.6.14 |
| GHSA-rgf6-9q7g-55qg Typo3 Function Menu API XSS Vulnerability |
Low EPSS 1.18% |
>= 4.5.0, < 4.5.21 | 4.5.21 |
| GHSA-qmmw-ch2q-j6xx Typo3 Backend API XSS Vulnerability |
Low EPSS 1.82% |
>= 4.7.0, < 4.7.6 | 4.7.6 |
| GHSA-qmmw-ch2q-j6xx Typo3 Backend API XSS Vulnerability |
Low EPSS 1.82% |
>= 4.6.0, < 4.6.14 | 4.6.14 |
| GHSA-qmmw-ch2q-j6xx Typo3 Backend API XSS Vulnerability |
Low EPSS 1.82% |
>= 4.5.0, < 4.5.21 | 4.5.21 |
| GHSA-w563-rq37-cvq5 Typo3 Backend History Module Vulnerable to XSS |
Low EPSS 1.18% |
>= 4.5.0, < 4.5.21 | 4.5.21 |
| GHSA-947m-vgqc-x6v4 Typo3 Backend History Module Vulnerable to SQL Injection |
Medium EPSS 2.17% |
>= 4.7.0, < 4.7.6 | 4.7.6 |
| GHSA-947m-vgqc-x6v4 Typo3 Backend History Module Vulnerable to SQL Injection |
Medium EPSS 2.17% |
>= 4.6.0, < 4.6.14 | 4.6.14 |
| GHSA-947m-vgqc-x6v4 Typo3 Backend History Module Vulnerable to SQL Injection |
Medium EPSS 2.17% |
>= 4.5.0, < 4.5.21 | 4.5.21 |
| GHSA-rgf6-9q7g-55qg Typo3 Function Menu API XSS Vulnerability |
Low EPSS 1.18% |
>= 4.7.0, < 4.7.6 | 4.7.6 |
| GHSA-w563-rq37-cvq5 Typo3 Backend History Module Vulnerable to XSS |
Low EPSS 1.18% |
>= 4.7.0, < 4.7.6 | 4.7.6 |
| GHSA-w563-rq37-cvq5 Typo3 Backend History Module Vulnerable to XSS |
Low EPSS 1.18% |
>= 4.6.0, < 4.6.14 | 4.6.14 |
| GHSA-r8m7-792j-5jvq TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component |
Low EPSS 1.09% |
>= 6.1.0, < 6.1.7 | 6.1.7 |
| GHSA-r8m7-792j-5jvq TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component |
Low EPSS 1.09% |
>= 4.7.0, < 4.7.17 | 4.7.17 |
| GHSA-r8m7-792j-5jvq TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component |
Low EPSS 1.09% |
>= 6.0.0, < 6.0.12 | 6.0.12 |
| GHSA-r8m7-792j-5jvq TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component |
Low EPSS 1.09% |
>= 4.5.0, < 4.5.32 | 4.5.32 |
| GHSA-fh4q-hxrw-cjqq TYPO3 Arbitrary Code Execution |
High EPSS 2.31% |
>= 8.0.0, < 8.7.5 | 8.7.5 |
| GHSA-fh4q-hxrw-cjqq TYPO3 Arbitrary Code Execution |
High EPSS 2.31% |
>= 7.6.0, < 7.6.22 | 7.6.22 |
| GHSA-594h-cx6w-p4jf Typo3 Host Header Spoofing Vulnerability |
Medium EPSS 2.71% |
>= 6.0.0, < 6.0.14 | 6.0.14 |
| GHSA-594h-cx6w-p4jf Typo3 Host Header Spoofing Vulnerability |
Medium EPSS 2.71% |
>= 4.7.0, < 4.7.19 | 4.7.19 |
| GHSA-594h-cx6w-p4jf Typo3 Host Header Spoofing Vulnerability |
Medium EPSS 2.71% |
>= 6.1.0, < 6.1.9 | 6.1.9 |
| GHSA-594h-cx6w-p4jf Typo3 Host Header Spoofing Vulnerability |
Medium EPSS 2.71% |
>= 4.5.0, < 4.5.34 | 4.5.34 |
| GHSA-594h-cx6w-p4jf Typo3 Host Header Spoofing Vulnerability |
Medium EPSS 2.71% |
>= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-55g3-fjwm-w2c8 TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code |
High EPSS 1.63% |
>= 6.0.0, < 6.0.14 | 6.0.14 |
| GHSA-qqh2-h6gw-6x8x Typo3 XSS Vulnerabilities |
Low EPSS 1.45% |
>= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-qqh2-h6gw-6x8x Typo3 XSS Vulnerabilities |
Low EPSS 1.45% |
>= 6.1.0, < 6.1.9 | 6.1.9 |
| GHSA-qqh2-h6gw-6x8x Typo3 XSS Vulnerabilities |
Low EPSS 1.45% |
>= 6.0.0, < 6.0.14 | 6.0.14 |
| GHSA-qqh2-h6gw-6x8x Typo3 XSS Vulnerabilities |
Low EPSS 1.45% |
>= 4.7.0, < 4.7.19 | 4.7.19 |
| GHSA-qqh2-h6gw-6x8x Typo3 XSS Vulnerabilities |
Low EPSS 1.45% |
>= 4.5.0, < 4.5.34 | 4.5.34 |
| GHSA-55g3-fjwm-w2c8 TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code |
High EPSS 1.63% |
>= 4.5.0, < 4.5.34 | 4.5.34 |
| GHSA-55g3-fjwm-w2c8 TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code |
High EPSS 1.63% |
>= 4.7.0, < 4.7.19 | 4.7.19 |
| GHSA-55g3-fjwm-w2c8 TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code |
High EPSS 1.63% |
>= 6.1.0, < 6.1.9 | 6.1.9 |
| GHSA-3w22-wrwx-2r75 Typo3 XSS Vulnerability |
Medium EPSS 2.17% |
< 9.2.0 | 9.2.0 |
| GHSA-989h-wv8x-933p TYPO3 cross-site scripting (XSS) |
Low EPSS 2.01% |
>= 6.0, < 6.2.15 | 6.2.15 |
| GHSA-989h-wv8x-933p TYPO3 cross-site scripting (XSS) |
Low EPSS 2.01% |
>= 7.0, < 7.4.0 | 7.4.0 |
| GHSA-989h-wv8x-933p TYPO3 cross-site scripting (XSS) |
Low EPSS 2.01% |
>= 4.0, <= 4.5.40 | No fix yet |
| GHSA-87hc-phmj-rhgh TYPO3 Information Disclosure Vulnerability |
Medium EPSS 0.99% |
No fix yet | |
| GHSA-j6c3-3c4w-qv8p Moodle cross-site scripting (XSS) vulnerabilities |
Medium EPSS 2.40% |
>= 7.0.0, < 7.3.1 | 7.3.1 |
| GHSA-j6c3-3c4w-qv8p Moodle cross-site scripting (XSS) vulnerabilities |
Medium EPSS 2.40% |
>= 6.2.0, < 6.2.14 | 6.2.14 |
| GHSA-4h9j-f98m-p4hg TYPO3 PHP remote file inclusion vulnerability |
High EPSS 1.16% |
>= 4.3.0, < 4.3.3 | 4.3.3 |
| GHSA-hwrc-w5gg-f335 TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential |
Medium EPSS 2.06% |
>= 4.3beta1, < 4.3beta2 | 4.3beta2 |
| GHSA-hwrc-w5gg-f335 TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential |
Medium EPSS 2.06% |
<= 4.0.13 | No fix yet |
| GHSA-hwrc-w5gg-f335 TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential |
Medium EPSS 2.06% |
>= 4.1.0, < 4.1.13 | 4.1.13 |
| GHSA-hwrc-w5gg-f335 TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential |
Medium EPSS 2.06% |
>= 4.2.0, < 4.2.10 | 4.2.10 |
| GHSA-jg55-3q6h-2ccf Typo3 Backend XSS Vulnerability |
Medium EPSS 1.06% |
>= 4.0, < 4.0.12 | 4.0.12 |
| GHSA-jg55-3q6h-2ccf Typo3 Backend XSS Vulnerability |
Medium EPSS 1.06% |
>= 4.1.0, < 4.1.10 | 4.1.10 |
| GHSA-jg55-3q6h-2ccf Typo3 Backend XSS Vulnerability |
Medium EPSS 1.06% |
No fix yet | |
| GHSA-jg55-3q6h-2ccf Typo3 Backend XSS Vulnerability |
Medium EPSS 1.06% |
>= 4.2.0, < 4.2.6 | 4.2.6 |
| GHSA-jg55-3q6h-2ccf Typo3 Backend XSS Vulnerability |
Medium EPSS 1.06% |
>= 3.3.0 | No fix yet |
| GHSA-c22j-84c7-cm77 TYPO3 leaks a hash secret in an error message |
Medium EPSS 42.23% |
>= 4.1, < 4.1.10 | 4.1.10 |
| GHSA-c22j-84c7-cm77 TYPO3 leaks a hash secret in an error message |
Medium EPSS 42.23% |
>= 4.2, < 4.2.6 | 4.2.6 |
| GHSA-c22j-84c7-cm77 TYPO3 leaks a hash secret in an error message |
Medium EPSS 42.23% |
>= 3.3, < 4.0.12 | 4.0.12 |
| GHSA-74w6-ww7w-45j9 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection |
High EPSS 3.31% |
>= 4.0.0, < 4.0.10 | 4.0.10 |
| GHSA-74w6-ww7w-45j9 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection |
High EPSS 3.31% |
>= 4.2.0, < 4.2.4 | 4.2.4 |
| GHSA-74w6-ww7w-45j9 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection |
High EPSS 3.31% |
>= 4.1.0, < 4.1.8 | 4.1.8 |
| GHSA-q45q-5233-229p Authentication library in TYPO3 vulnerable to session fixation |
High EPSS 1.79% |
>= 4.0.0, < 4.0.10 | 4.0.10 |
| GHSA-q45q-5233-229p Authentication library in TYPO3 vulnerable to session fixation |
High EPSS 1.79% |
>= 4.1.0, < 4.1.8 | 4.1.8 |
| GHSA-q45q-5233-229p Authentication library in TYPO3 vulnerable to session fixation |
High EPSS 1.79% |
>= 4.2.0, < 4.2.4 | 4.2.4 |
| GHSA-xj84-6q8f-qg2r TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/` |
High EPSS 1.38% |
< 3.8.1 | 3.8.1 |
| GHSA-gx4p-6w86-f8jx Typo3 SQL injection due to faulty prepared statements |
Critical EPSS 1.37% |
>= 4.5.0, <= 4.5.5 | No fix yet |
| GHSA-h86g-796f-hhfq Typo3 XSS Vulnerabilities |
Medium EPSS 0.68% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-q22w-r5qq-v3wf Typo3 XSS in RemoveXSS function |
Medium EPSS 0.83% |
< 4.3.12 | 4.3.12 |
| GHSA-q22w-r5qq-v3wf Typo3 XSS in RemoveXSS function |
Medium EPSS 0.83% |
>= 4.4.0, < 4.4.9 | 4.4.9 |
| GHSA-q22w-r5qq-v3wf Typo3 XSS in RemoveXSS function |
Medium EPSS 0.83% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-qf79-34j4-54m6 Typo3 Improper Access Control |
Medium EPSS 1.14% |
< 4.4.9 | 4.4.9 |
| GHSA-qf79-34j4-54m6 Typo3 Improper Access Control |
Medium EPSS 1.14% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-h86g-796f-hhfq Typo3 XSS Vulnerabilities |
Medium EPSS 0.68% |
>= 4.4.0, < 4.4.9 | 4.4.9 |
| GHSA-h86g-796f-hhfq Typo3 XSS Vulnerabilities |
Medium EPSS 0.68% |
< 4.3.12 | 4.3.12 |
| GHSA-rwx5-7x5r-jgrm Typo3 Information Disclosure |
Medium EPSS 0.95% |
< 4.5.4 | 4.5.4 |
| GHSA-29wr-24h5-95r5 Typo3 XSS Vulnerability |
Medium EPSS 0.68% |
< 4.3.12 | 4.3.12 |
| GHSA-29wr-24h5-95r5 Typo3 XSS Vulnerability |
Medium EPSS 0.68% |
>= 4.4.0, < 4.4.9 | 4.4.9 |
| GHSA-79gv-5cgx-x6rx Typo3 Authentication Bypass |
Critical EPSS 1.65% |
< 4.3.12 | 4.3.12 |
| GHSA-79gv-5cgx-x6rx Typo3 Authentication Bypass |
Critical EPSS 1.65% |
>= 4.4.0, < 4.4.9 | 4.4.9 |
| GHSA-29wr-24h5-95r5 Typo3 XSS Vulnerability |
Medium EPSS 0.68% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-8grp-3j5v-543g Typo3 Arbitrary Information Disclosure |
Medium EPSS 1.14% |
< 4.3.12 | 4.3.12 |
| GHSA-8grp-3j5v-543g Typo3 Arbitrary Information Disclosure |
Medium EPSS 1.14% |
>= 4.4.0, < 4.4.9 | 4.4.9 |
| GHSA-8grp-3j5v-543g Typo3 Arbitrary Information Disclosure |
Medium EPSS 1.14% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-9vxq-mxw5-mcgp Typo3 Arbitrary File Delete |
Medium EPSS 0.98% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-9vxq-mxw5-mcgp Typo3 Arbitrary File Delete |
Medium EPSS 0.98% |
>= 4.4.0, < 4.4.9 | 4.4.9 |
| GHSA-9vxq-mxw5-mcgp Typo3 Arbitrary File Delete |
Medium EPSS 0.98% |
< 4.3.12 | 4.3.12 |
| GHSA-79gv-5cgx-x6rx Typo3 Authentication Bypass |
Critical EPSS 1.65% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-frf4-5p2c-c3ff Typo3 Information Disclosure |
Medium EPSS 0.95% |
>= 4.5.0, < 4.5.4 | 4.5.4 |
| GHSA-frf4-5p2c-c3ff Typo3 Information Disclosure |
Medium EPSS 0.95% |
< 4.3.12 | 4.3.12 |
| GHSA-frf4-5p2c-c3ff Typo3 Information Disclosure |
Medium EPSS 0.95% |
>= 4.4.0, < 4.4.9 | 4.4.9 |
| GHSA-657m-v5vm-f6rw Cross-Site-Request-Forgery in Backend |
High EPSS 0.64% |
>= 11.2.0, < 11.5.0 | 11.5.0 |
| GHSA-m2jh-fxw4-gphm HTTP Host Header Injection |
Medium EPSS 1.22% |
>= 11.0.0, < 11.5.0 | 11.5.0 |
| GHSA-c5c9-8c6m-727v Cross-Site Scripting via Rich-Text Content |
Medium EPSS 0.73% |
>= 10.0.0, < 10.4.19 | 10.4.19 |
| GHSA-c5c9-8c6m-727v Cross-Site Scripting via Rich-Text Content |
Medium EPSS 0.73% |
>= 7.0.0, < 7.6.53 | 7.6.53 |
| GHSA-c5c9-8c6m-727v Cross-Site Scripting via Rich-Text Content |
Medium EPSS 0.73% |
>= 8.0.0, < 8.7.42 | 8.7.42 |
| GHSA-c5c9-8c6m-727v Cross-Site Scripting via Rich-Text Content |
Medium EPSS 0.73% |
>= 11.0.0, < 11.3.2 | 11.3.2 |
| GHSA-c5c9-8c6m-727v Cross-Site Scripting via Rich-Text Content |
Medium EPSS 0.73% |
>= 9.0.0, < 9.5.29 | 9.5.29 |
| GHSA-34fr-fhqr-7235 Information Disclosure in User Authentication |
Medium EPSS 0.83% |
>= 9.0.0, < 9.5.28 | 9.5.28 |
| GHSA-34fr-fhqr-7235 Information Disclosure in User Authentication |
Medium EPSS 0.83% |
>= 11.0.0, < 11.3.1 | 11.3.1 |
| GHSA-34fr-fhqr-7235 Information Disclosure in User Authentication |
Medium EPSS 0.83% |
>= 10.0.0, < 10.4.18 | 10.4.18 |
| GHSA-rgcg-28xm-8mmw Cross-Site Scripting in Backend Grid View |
Medium EPSS 0.60% |
>= 9.0.0, < 9.5.28 | 9.5.28 |
| GHSA-rgcg-28xm-8mmw Cross-Site Scripting in Backend Grid View |
Medium EPSS 0.60% |
>= 11.0.0, < 11.3.1 | 11.3.1 |
| GHSA-rgcg-28xm-8mmw Cross-Site Scripting in Backend Grid View |
Medium EPSS 0.60% |
>= 10.0.0, < 10.4.18 | 10.4.18 |
| GHSA-6mh3-j5r5-2379 Cross-Site Scripting in Query Generator & Query View |
Medium EPSS 0.60% |
>= 9.0.0, < 9.5.28 | 9.5.28 |
| GHSA-6mh3-j5r5-2379 Cross-Site Scripting in Query Generator & Query View |
Medium EPSS 0.60% |
>= 10.0.0, < 10.4.18 | 10.4.18 |
| GHSA-6mh3-j5r5-2379 Cross-Site Scripting in Query Generator & Query View |
Medium EPSS 0.60% |
>= 11.0.0, < 11.3.1 | 11.3.1 |
| GHSA-8mq9-fqv8-59wf Cross-Site Scripting in Page Preview |
Medium EPSS 0.60% |
>= 10.0.0, < 10.4.18 | 10.4.18 |
| GHSA-8mq9-fqv8-59wf Cross-Site Scripting in Page Preview |
Medium EPSS 0.60% |
>= 9.0.0, < 9.5.28 | 9.5.28 |
| GHSA-8mq9-fqv8-59wf Cross-Site Scripting in Page Preview |
Medium EPSS 0.60% |
>= 11.0.0, < 11.3.1 | 11.3.1 |
| GHSA-x7hc-x7fm-f7qh Cross-Site Scripting in Content Preview (CType menu) |
Medium EPSS 0.87% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-x7hc-x7fm-f7qh Cross-Site Scripting in Content Preview (CType menu) |
Medium EPSS 0.87% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-x7hc-x7fm-f7qh Cross-Site Scripting in Content Preview (CType menu) |
Medium EPSS 0.87% |
>= 9.0.0, < 9.5.25 | 9.5.25 |
| GHSA-4p9g-qgx9-397p Denial of Service in Page Error Handling |
Medium EPSS 1.73% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-4p9g-qgx9-397p Denial of Service in Page Error Handling |
Medium EPSS 1.73% |
>= 9.0.0, < 9.5.25 | 9.5.25 |
| GHSA-4p9g-qgx9-397p Denial of Service in Page Error Handling |
Medium EPSS 1.73% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-x79j-wgqv-g8h2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form |
Medium EPSS 0.87% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-x79j-wgqv-g8h2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form |
Medium EPSS 0.87% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-3vg7-jw9m-pc3f Broken Access Control in Form Framework |
High EPSS 1.61% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-3vg7-jw9m-pc3f Broken Access Control in Form Framework |
High EPSS 1.61% |
>= 9.0.0, < 9.5.25 | 9.5.25 |
| GHSA-3vg7-jw9m-pc3f Broken Access Control in Form Framework |
High EPSS 1.61% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-2r6j-862c-m2v2 Unrestricted File Upload in Form Framework |
High EPSS 1.63% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-2r6j-862c-m2v2 Unrestricted File Upload in Form Framework |
High EPSS 1.63% |
>= 9.0.0, < 9.5.25 | 9.5.25 |
| GHSA-2r6j-862c-m2v2 Unrestricted File Upload in Form Framework |
High EPSS 1.63% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-fjh3-g8gq-9q92 Cross-Site Scripting in Content Preview |
Medium EPSS 0.87% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-fjh3-g8gq-9q92 Cross-Site Scripting in Content Preview |
Medium EPSS 0.87% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-qx3w-4864-94ch Cleartext storage of session identifier |
Medium EPSS 0.92% |
>= 9.0.0, < 9.5.25 | 9.5.25 |
| GHSA-qx3w-4864-94ch Cleartext storage of session identifier |
Medium EPSS 0.92% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-qx3w-4864-94ch Cleartext storage of session identifier |
Medium EPSS 0.92% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-4jhw-2p6j-5wmp Open Redirection in Login Handling |
Medium EPSS 1.10% |
>= 9.0.0, < 9.5.25 | 9.5.25 |
| GHSA-4jhw-2p6j-5wmp Open Redirection in Login Handling |
Medium EPSS 1.10% |
>= 11.0.0, < 11.1.1 | 11.1.1 |
| GHSA-4jhw-2p6j-5wmp Open Redirection in Login Handling |
Medium EPSS 1.10% |
>= 10.0.0, < 10.4.14 | 10.4.14 |
| GHSA-vqqx-jw6p-q3rf Cross-Site Scripting in Fluid view helpers |
Medium EPSS 0.72% |
>= 9.0.0, < 9.5.23 | 9.5.23 |
| GHSA-vqqx-jw6p-q3rf Cross-Site Scripting in Fluid view helpers |
Medium EPSS 0.72% |
>= 10.0.0, < 10.4.10 | 10.4.10 |
| GHSA-vqqx-jw6p-q3rf Cross-Site Scripting in Fluid view helpers |
Medium EPSS 0.72% |
>= 8.7.0, < 8.7.38 | 8.7.38 |
| GHSA-q9cp-mc96-m4w2 XML External Entity in Dashboard Widget |
Low EPSS 0.64% |
>= 10.0.0, < 10.4.10 | 10.4.10 |
| GHSA-954j-f27r-cj52 Cleartext storage of session identifier |
High EPSS 0.68% |
>= 10.0.0, < 10.4.10 | 10.4.10 |
| GHSA-954j-f27r-cj52 Cleartext storage of session identifier |
High EPSS 0.68% |
>= 8.7.0, < 8.7.38 | 8.7.38 |
| GHSA-954j-f27r-cj52 Cleartext storage of session identifier |
High EPSS 0.68% |
>= 9.0.0, < 9.5.23 | 9.5.23 |
| GHSA-7733-hjv6-4h47 Cross-Site Scripting in ternary conditional operator |
Medium EPSS 0.97% |
>= 8.0.0, < 8.7.25 | 8.7.25 |
| GHSA-7733-hjv6-4h47 Cross-Site Scripting in ternary conditional operator |
Medium EPSS 0.97% |
>= 9.0.0, < 9.5.6 | 9.5.6 |
| GHSA-3x94-fv5h-5q2c Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS |
High EPSS 1.79% |
>= 9.0.0, < 9.5.20 | 9.5.20 |
| GHSA-3x94-fv5h-5q2c Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS |
High EPSS 1.79% |
>= 10.0.0, < 10.4.6 | 10.4.6 |
| GHSA-m5vr-3m74-jwxp Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS |
High EPSS 2.23% |
>= 10.0.0, < 10.4.6 | 10.4.6 |
| GHSA-m5vr-3m74-jwxp Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS |
High EPSS 2.23% |
>= 9.0.0, < 9.5.20 | 9.5.20 |
| GHSA-pqg8-crx9-g8m4 Backend Same-Site Request Forgery in TYPO3 CMS |
High EPSS 0.74% |
>= 9.0.0, < 9.5.17 | 9.5.17 |
| GHSA-pqg8-crx9-g8m4 Backend Same-Site Request Forgery in TYPO3 CMS |
High EPSS 0.74% |
>= 10.0.0, < 10.4.2 | 10.4.2 |
| GHSA-2wj9-434x-9hvp Insecure Deserialization in Backend User Settings in TYPO3 CMS |
High EPSS 1.99% |
>= 10.0.0, < 10.4.2 | 10.4.2 |
| GHSA-2wj9-434x-9hvp Insecure Deserialization in Backend User Settings in TYPO3 CMS |
High EPSS 1.99% |
>= 9.0.0, < 9.5.17 | 9.5.17 |
| GHSA-2rxh-h6h9-qrqc Class destructors causing side-effects when being unserialized in TYPO3 CMS |
High EPSS 1.51% |
>= 10.0.0, < 10.4.2 | 10.4.2 |
| GHSA-2rxh-h6h9-qrqc Class destructors causing side-effects when being unserialized in TYPO3 CMS |
High EPSS 1.51% |
>= 9.0.0, < 9.5.17 | 9.5.17 |
| GHSA-4j77-gg36-9864 Cross-Site Scripting in TYPO3 CMS Link Handling |
Medium EPSS 0.54% |
>= 9.0.0, < 9.5.17 | 9.5.17 |
| GHSA-4j77-gg36-9864 Cross-Site Scripting in TYPO3 CMS Link Handling |
Medium EPSS 0.54% |
>= 10.0.0, < 10.4.2 | 10.4.2 |
| GHSA-43gj-mj2w-wh46 Cross-Site Scripting in TYPO3 CMS Form Engine |
Medium EPSS 0.54% |
>= 10.0.0, < 10.4.2 | 10.4.2 |
| GHSA-43gj-mj2w-wh46 Cross-Site Scripting in TYPO3 CMS Form Engine |
Medium EPSS 0.54% |
>= 9.0.0, < 9.5.17 | 9.5.17 |
| GHSA-347x-877p-hcwx Information Disclosure in Password Reset |
Low EPSS 1.22% |
>= 10.0.0, < 10.4.2 | 10.4.2 |
| GHSA-w2fr-65vp-mxw3 Deserialization of untrusted data in Symfony |
High EPSS 2.26% |
>= 9.0.0, < 9.5.8 | 9.5.8 |
| GHSA-g68x-vvqq-pvw3 Ckeditor XSS Vulnerability |
Medium EPSS 1.95% |
>= 9.0.0, < 9.5.2 | 9.5.2 |
| GHSA-g68x-vvqq-pvw3 Ckeditor XSS Vulnerability |
Medium EPSS 1.95% |
>= 8.0.0, < 8.7.21 | 8.7.21 |
| GHSA-pj7m-g53m-7638 Bootstrap Cross-site Scripting vulnerability |
Medium EPSS 4.31% |
>= 8.0.0, < 8.7.23 | 8.7.23 |
| GHSA-pj7m-g53m-7638 Bootstrap Cross-site Scripting vulnerability |
Medium EPSS 4.31% |
>= 9.0.0, < 9.5.4 | 9.5.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor