Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

typo3/cms

116 known vulnerabilities (12 high, 36 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
116 · 12 high, 36 medium, 2 low
Registry
Packagist

Advisories 116

  • Persisted Cross-Site Scripting in Frontend Rendering in typo3

    Affected: from 10.0.0, fixed in 10.4.35; from 11.0.0, fixed in 11.5.23; from 12.0.0, fixed in 12.2.0.

  • CVE-2022-23504Medium 5.7

    TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

    Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

  • TYPO3 vulnerable to Arbitrary Code Execution via Form Framework

    Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

  • CVE-2022-23502Medium 5.4

    TYPO3 contains Insufficient Session Expiration after Password Reset

    Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

  • CVE-2022-23501Medium 5.9

    TYPO3 vulnerable to Improper Authentication in Frontend Login

    Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

  • CVE-2022-23500Medium 5.9

    TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service

    Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20.

  • CVE-2022-47406Medium 5.4

    An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for…

    Affected: fixed in 2.0.5; from 3.0.0, fixed in 3.0.3.

  • CVE-2022-23499Medium 6.1

    Cross-Site Scripting Protection bypass in HTML Sanitizer

    Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

  • CVE-2022-36105Medium 5.3

    User Enumeration via Response Timing in TYPO3

    Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

  • CVE-2022-36106Medium 5.4

    Missing check for expiration time of password reset token in TYPO3

    Affected: from 10.4.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

  • CVE-2022-36107Medium 6.5

    Stored Cross-Site Scripting via FileDumpController

    Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

  • CVE-2022-36104Medium 5.9

    Denial of Service via Page Error Handling in TYPO3/cms

    Affected: from 11.4.0, fixed in 11.5.16.

  • CVE-2022-36108Medium 6.5

    Cross-Site Scripting in typo3/cms-core

    Affected: from 10.3.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

  • CVE-2022-36020Medium 6.1

    Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

    Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

  • CVE-2022-31050Medium 6.0

    Insufficient Session Expiration in TYPO3 Admin Tool

    Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

Show all 116 advisoriesShow fewer advisories
  • CVE-2022-31048Medium 5.4

    Cross-Site Scripting in Form Framework

    Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

  • CVE-2022-31049Medium 5.4

    Cross-Site Scripting in Frontend Login Mailer

    Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

  • CVE-2022-31046Medium 4.3

    Information Disclosure via Export Module in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

  • CVE-2022-31047Medium 5.3

    Insertion of Sensitive Information into Log File in typo3/cms-core

    Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

  • Cross-Site-Request-Forgery in Backend URI Handling in Typo3

    Affected: from 11.2.0, fixed in 11.5.0.

  • CVE-2021-41114Medium 4.8

    HTTP Host Header Injection in Request Handling in Typo3

    Affected: from 11.0.0, fixed in 11.5.0.

  • CVE-2021-32768Medium 6.1

    Cross-Site Scripting via Rich-Text Content

    Affected: from 10.0.0, fixed in 10.4.19; from 11.0.0, fixed in 11.3.2; from 9.0.0, fixed in 9.5.29; from 8.0.0, fixed in 8.7.42; from 7.0.0, fixed in 7.6.53.

  • CVE-2021-32767Medium 5.3

    Information Disclosure in User Authentication

    Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

  • CVE-2021-32669Medium 6.4

    Cross-Site Scripting in Backend Grid View

    Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

  • CVE-2021-32668Medium 6.4

    Cross-Site Scripting in Query Generator & Query View

    Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

  • CVE-2021-32667Medium 6.4

    Cross-Site Scripting in Page Preview

    Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

  • CVE-2021-21359Medium 5.9

    Denial of Service in Page Error Handling

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

  • CVE-2021-21370Medium 5.4

    Cross-Site Scripting in Content Preview (CType menu)

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

  • CVE-2021-21339Medium 5.9

    Cleartext storage of session identifier

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

  • CVE-2021-21340Medium 5.4

    Cross-Site Scripting in Content Preview

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

  • Unrestricted File Upload in Form Framework

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

  • Broken Access Control in Form Framework

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

  • CVE-2021-21358Medium 5.4

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

  • CVE-2021-21338Medium 4.7

    Open Redirection in Login Handling

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

  • XML External Entity in Dashboard Widget

    Affected: from 10.0.0, fixed in 10.4.10.

  • Cleartext storage of session identifier

    Affected: from 10.0.0, fixed in 10.4.10; from 9.0.0, fixed in 9.5.23; from 8.7.0, fixed in 8.7.38.

  • CVE-2020-26227Medium 6.1

    Cross-Site Scripting in Fluid view helpers

    Affected: from 10.0.0, fixed in 10.4.10; from 9.0.0, fixed in 9.5.23; from 8.7.0, fixed in 8.7.38.

  • CVE-2020-15241Medium 4.7

    Cross-Site Scripting in TYPO3 Fluid Engine

    Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.

  • Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.6; from 9.0.0, fixed in 9.5.20.

  • Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.6; from 9.0.0, fixed in 9.5.20.

  • Cross-Site Request Forgery in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

  • Deserialization of Untrusted Data in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

  • Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

  • CVE-2020-11065Medium 5.4

    Cross-Site Scripting in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

  • CVE-2020-11064Medium 5.4

    Cross-Site Scripting in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

  • Observable Response Discrepancy in TYPO3 CMS

    Affected: from 10.0.0, fixed in 10.4.2.

  • CVE-2020-8091Medium 4.8

    svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting…

    Affected: from 7.0.0, fixed in 7.2.0; from 6.2.0, fixed in 6.2.39.

  • An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

    Affected: from 10.0.0, fixed in 10.2.1; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.

  • CVE-2019-19850Medium 5.5

    An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

    Affected: from 8.0, fixed in 8.7.30; from 9.0, fixed in 9.5.12; from 10.0, fixed in 10.2.2.

  • CVE-2019-19848Medium 6.8

    An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

    Affected: from 10.0.0, fixed in 10.2.2; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.

  • It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced…

    Affected: from 4.5.0, through 4.5.5.

  • TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to…

    Affected: fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

  • Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary…

    Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

  • TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.

    Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

  • TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3…

    Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

  • TYPO3 before 4.5.4 allows Information Disclosure in the backend.

    Affected: fixed in 4.5.4.

  • Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary…

    Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

  • Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary…

    Affected: from 4.5.0, fixed in 4.5.4; from 4.4.0, fixed in 4.4.9; fixed in 4.3.12.

  • TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend…

    Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

  • TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.

    Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

  • TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.

    Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.

  • TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.

    Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.

  • In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain…

    Affected: from 9.0.0, fixed in 9.5.8.

  • TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for…

    Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.

  • CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

    Affected: from 8.0.0, fixed in 8.7.21; from 9.0.0, fixed in 9.5.2.

  • In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

    Affected: from 8.0.0, fixed in 8.7.23; from 9.0.0, fixed in 9.5.4.

  • The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin…

    Affected: fixed in 9.2.0.

  • Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to…

    Affected: from 7.6.0, fixed in 7.6.22; from 8.0.0, fixed in 8.7.5.

  • TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to…

    Affected: versions 7.6.15.

  • Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary…

    Affected: from 6.2.0, fixed in 6.2.19.

  • The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified…

    Affected: from 6.2.0, fixed in 6.2.16.

  • Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote…

    Affected: from 6.2.0, fixed in 6.2.16; from 7.0.0, fixed in 7.6.1.

  • Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before…

    Affected: from 6.2.0, fixed in 6.2.16.

  • Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1…

    Affected: from 6.2, fixed in 6.2.16; from 7.0, fixed in 7.6.1.

  • The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to…

    Affected: from 6.0, fixed in 6.2.15; from 7.0, fixed in 7.4.0; from 4.0, through 4.5.40.

  • The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when…

    Affected: from 4.5.0, fixed in 4.5.39; from 6.2.0, fixed in 6.2.9; from 7.0.0, fixed in 7.0.2; from 4.6.0, fixed in 4.6.19; from 4.7.0, fixed in 4.7.21; from 6.0.0, fixed in 6.0.15; from 6.1.0, fixed in 6.1.13.

  • The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when…

    Affected: from 4.5.0, fixed in 4.5.39; from 4.6.0, fixed in 6.2.9; from 7.0.0, fixed in 7.0.2.

  • The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group…

    Affected: from 6.2.0, fixed in 6.2.3.

  • The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the…

    Affected: fixed in 6.2.0.

  • The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote…

    Affected: from 6.2.0, fixed in 6.2.3.

  • Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19…

    Affected: from 4.5.0, fixed in 4.5.34; from 4.7.0, fixed in 4.7.19; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.3.

  • The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows…

    Affected: from 4.5.0, fixed in 4.5.34; from 4.7.0, fixed in 4.7.19; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.9.

  • TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to…

    Affected: from 4.5.0, fixed in 4.5.34; from 4.7.0, fixed in 4.7.19; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.3.

  • The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute…

    Affected: from 6.0.0, fixed in 6.0.9; from 6.1.0, fixed in 6.1.4.

  • The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly…

    Affected: from 6.0.0, fixed in 6.0.8; from 6.1.0, fixed in 6.1.3.

  • The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access…

    Affected: from 4.5, fixed in 4.5.21; from 4.6, fixed in 4.6.14; from 4.7, fixed in 4.7.6.

  • Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before…

    Affected: from 6.2.0, fixed in 6.2.14; from 7.0.0, fixed in 7.3.1.

  • The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6…

    Affected: from 4.5.0, fixed in 4.5.32; from 4.7.0, fixed in 4.7.17; from 6.0.0, fixed in 6.0.12; from 6.1.0, fixed in 6.1.7.

  • The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6…

    Affected: from 4.5.0, fixed in 4.5.32; from 4.7.0, fixed in 4.7.17; from 6.0.0, fixed in 6.0.12; from 6.1.0, fixed in 6.1.7.

  • Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x…

    Affected: from 4.5.0, fixed in 4.5.32; from 4.7.0, fixed in 4.7.17; from 6.0.0, fixed in 6.0.12; from 6.1.0, fixed in 6.1.7.

  • Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet…

    Affected: from 6.2.0, fixed in 6.2.6.

  • Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before…

    Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

  • Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before…

    Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

  • Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before…

    Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

  • SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows…

    Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

  • Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4…

    Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

  • Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x…

    Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

  • The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote…

    Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

  • Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before…

    Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

  • view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote…

    Affected: from 4.5.0, fixed in 4.5.19; from 4.6.0, fixed in 4.6.12; from 4.7.0, fixed in 4.7.4.

  • The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote…

    Affected: from 4.4.0, fixed in 4.4.14; from 4.5.0, fixed in 4.5.14; from 4.6.0, fixed in 4.6.7.

  • The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows…

    Affected: from 4.4.0, through 4.4.13; from 4.5.0, through 4.5.13; from 4.6.0, through 4.6.6.

  • Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0…

    Affected: from 4.4.0, fixed in 4.4.14; from 4.5.0, fixed in 4.5.14; from 4.6.0, fixed in 4.6.7.

  • The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize…

    Affected: from 4.6, fixed in 4.6.7; from 4.4.0, fixed in 4.4.14; from 4.5.0, fixed in 4.5.14.

  • Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8…

    Affected: from 4.4, fixed in 4.4.15; from 4.5, fixed in 4.5.15; from 4.6, fixed in 4.6.8; versions 4.7.

  • The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x…

    Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.

  • SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote…

    Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.

  • Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows…

    Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.

  • The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x…

    Affected: from 4.2.0, fixed in 4.2.15; from 4.3.0, fixed in 4.3.7; from 4.4.0, fixed in 4.4.4.

  • PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP…

    Affected: from 4.3.0, fixed in 4.3.3.

  • The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows…

    Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3beta1, fixed in 4.3beta2.

  • Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1…

    Affected: from 3.3.0; from 4.0, fixed in 4.0.12; from 4.1.0, fixed in 4.1.10; from 4.2.0, fixed in 4.2.6; versions 4.3alpha1.

  • The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and…

    Affected: from 3.3, fixed in 4.0.12; from 4.1, fixed in 4.1.10; from 4.2, fixed in 4.2.6.

  • The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3…

    Affected: from 4.0.0, fixed in 4.0.10; from 4.1.0, fixed in 4.1.8; from 4.2.0, fixed in 4.2.4.

  • Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3…

    Affected: from 4.0.0, fixed in 4.0.10; from 4.1.0, fixed in 4.1.8; from 4.2.0, fixed in 4.2.4.

  • TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the…

    Affected: fixed in 3.8.1.