[MEDIUM] Typo3 XSS Vulnerability

PKSA-j487-wgb6-g37w CVE-2018-6905 GHSA-3w22-wrwx-2r75

Affected version: <9.2.0

Reported by:
GitHub

[HIGH] TYPO3-CORE-SA-2020-011: Cleartext storage of session identifier

PKSA-tb1c-8bnf-mvmf CVE-2020-26228 GHSA-954j-f27r-cj52

Affected version: >=10.0.0,<10.4.10|>=9.0.0,<9.5.23|>=8.7.0,<8.7.38

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] TYPO3-CORE-SA-2020-010: Cross-Site Scripting in Fluid view helpers

PKSA-7sv8-gd3z-zptc CVE-2020-26227 GHSA-vqqx-jw6p-q3rf

Affected version: >=10.0.0,<10.4.10|>=9.0.0,<9.5.23|>=8.7.0,<8.7.38

Reported by:
GitHub, FriendsOfPHP/security-advisories

Insecure Deserialization in Query Generator &amp; Query View

PKSA-fyxc-qkr6-f3ry CVE-2019-19849

Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12

Reported by:
FriendsOfPHP/security-advisories

SQL Injection in low-level Query Generator

PKSA-8qsb-zpqf-kwq2 CVE-2019-19850

Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12

Reported by:
FriendsOfPHP/security-advisories

Directory Traversal on ZIP extraction

PKSA-187n-yk48-q1fv CVE-2019-19848

Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Form Framework validation handling

PKSA-mk73-2ss9-7t3h

Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Link Handling

PKSA-mgq1-q3nx-4qhb

Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12

Reported by:
FriendsOfPHP/security-advisories

Possible Insecure Deserialization in Extbase Request Handling

PKSA-7wb5-3v3w-d2zd

Affected version: >=8.0.0,<8.7.30|>=9.0.0,<9.5.12

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Filelist Module

PKSA-jfwm-f2y6-dfw3

Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12

Reported by:
FriendsOfPHP/security-advisories

[HIGH] Insecure Deserialization in TYPO3 CMS

PKSA-bz6f-yjw4-93sv CVE-2019-12747 GHSA-86hp-xrhj-fhpq

Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] Cross-Site Scripting in Link Handling

PKSA-shfj-qhnv-r9fs CVE-2019-12748 GHSA-r6fv-56gp-j3r4

Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8

Reported by:
GitHub, FriendsOfPHP/security-advisories

Security Misconfiguration in Frontend Session Handling

PKSA-s18m-y85n-1v87

Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8

Reported by:
FriendsOfPHP/security-advisories

Arbitrary Code Execution and Cross-Site Scripting in Backend API

PKSA-5tf7-6x9k-c3q3

Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8

Reported by:
FriendsOfPHP/security-advisories

Information Disclosure in Backend User Interface

PKSA-vnc3-kwhr-kmwj

Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8

Reported by:
FriendsOfPHP/security-advisories

[HIGH] Possible Arbitrary Code Execution in Image Processing

PKSA-k6fx-zsn9-8q9f CVE-2019-11832 GHSA-3w4h-r27h-4r2w

Affected version: >=8.0.0,<8.7.25|>=9.0.0,<9.5.6

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] Cross-Site Scripting in Fluid Engine

PKSA-dmbp-4kzv-9s4r CVE-2020-15241 GHSA-7733-hjv6-4h47

Affected version: >=8.0.0,<8.7.25|>=9.0.0,<9.5.6

Reported by:
GitHub, FriendsOfPHP/security-advisories

Security Misconfiguration in User Session Handling

PKSA-r81x-w89x-1vq9

Affected version: >=8.0.0,<8.7.25|>=9.0.0,<9.5.6

Reported by:
FriendsOfPHP/security-advisories

[MEDIUM] Cross-Site Scripting in Bootstrap CSS toolkit

PKSA-ww37-6vs7-z8br CVE-2018-14041 GHSA-pj7m-g53m-7638

Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4

Reported by:
GitHub, FriendsOfPHP/security-advisories

Arbitrary Code Execution via File List Module

PKSA-5bn3-rb6y-yskr

Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4

Reported by:
FriendsOfPHP/security-advisories

Security Misconfiguration for Backend User Accounts

PKSA-vzzk-7qkd-5r89

Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4

Reported by:
FriendsOfPHP/security-advisories

Broken Access Control in Localization Handling

PKSA-1g5v-h1gj-cdpx

Affected version: >=8.0.0,<8.7.23

Reported by:
FriendsOfPHP/security-advisories

Information Disclosure of Installed Extensions

PKSA-5v3b-yhjz-2p8k

Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Form Framework

PKSA-1gbs-82ww-81jy

Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Fluid ViewHelpers

PKSA-x7y9-5n9c-2k2x

Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4

Reported by:
FriendsOfPHP/security-advisories

[MEDIUM] Cross-Site Scripting in CKEditor

PKSA-qmq7-q129-2wts CVE-2018-17960 GHSA-g68x-vvqq-pvw3

Affected version: >=8.0.0,<8.7.21|>=9.0.0,<9.5.2

Reported by:
GitHub, FriendsOfPHP/security-advisories

Information Disclosure in Install Tool

PKSA-t1pf-cbfj-xyc5

Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2

Reported by:
FriendsOfPHP/security-advisories

Denial of Service in Online Media Asset Handling

PKSA-41jf-hqcz-2mxn

Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Online Media Asset Rendering

PKSA-94ws-swjq-dm6m

Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Backend Modal Component

PKSA-qzm7-ztqf-vx98

Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2

Reported by:
FriendsOfPHP/security-advisories

Denial of Service in Frontend Record Registration

PKSA-6wyc-z3gy-thx1

Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21

Reported by:
FriendsOfPHP/security-advisories

Security Misconfiguration in Install Tool Cookie

PKSA-99fq-1t5c-yckv

Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in Frontend User Login

PKSA-j1v4-rzqw-fkx7

Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2

Reported by:
FriendsOfPHP/security-advisories

Insecure Deserialization in TYPO3 CMS

PKSA-bf3m-n5kt-vtz8

Affected version: >=8.5.0,<8.7.17|>=9.0.0,<9.3.2

Reported by:
FriendsOfPHP/security-advisories

Privilege Escalation & SQL Injection in TYPO3 CMS

PKSA-hg27-6v27-frzb

Affected version: >=8.5.0,<8.7.17|>=9.0.0,<9.3.2

Reported by:
FriendsOfPHP/security-advisories

Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS

PKSA-z3s2-rzbm-sz8q

Affected version: >=7.0.0,<7.6.30|>=8.0.0,<8.7.17|>=9.0.0,<9.3.2

Reported by:
FriendsOfPHP/security-advisories

Authentication Bypass in TYPO3 CMS

PKSA-b9qm-1gk1-gg53

Affected version: >=7.0.0,<7.6.30|>=8.0.0,<8.7.17|>=9.0.0,<9.3.2

Reported by:
FriendsOfPHP/security-advisories

Information Disclosure in TYPO3 CMS

PKSA-mnvr-nmxv-xndp

Affected version: >=7.6.0,<7.6.22|>=8.0.0,<8.1.0|>=8.1.0,<8.2.0|>=8.2.0,<8.3.0|>=8.3.0,<8.4.0|>=8.4.0,<8.5.0|>=8.5.0,<8.6.0|>=8.6.0,<8.7.0|>=8.7.0,<8.7.5

Reported by:
FriendsOfPHP/security-advisories

Information Disclosure in TYPO3 CMS

PKSA-k469-q3x3-m5wx

Affected version: >=7.6.0,<7.6.22|>=8.0.0,<8.1.0|>=8.1.0,<8.2.0|>=8.2.0,<8.3.0|>=8.3.0,<8.4.0|>=8.4.0,<8.5.0|>=8.5.0,<8.6.0|>=8.6.0,<8.7.0|>=8.7.0,<8.7.5

Reported by:
FriendsOfPHP/security-advisories

Arbitrary Code Execution in TYPO3 CMS

PKSA-ycd2-g5rr-5v84

Affected version: >=7.6.0,<7.6.22|>=8.0.0,<8.1.0|>=8.1.0,<8.2.0|>=8.2.0,<8.3.0|>=8.3.0,<8.4.0|>=8.4.0,<8.5.0|>=8.5.0,<8.6.0|>=8.6.0,<8.7.0|>=8.7.0,<8.7.5

Reported by:
FriendsOfPHP/security-advisories

Cross-Site Scripting in TYPO3 CMS Backend

PKSA-ytg9-3z8d-xh45

Affected version: >=8.0.0,<8.1.0|>=8.1.0,<8.2.0|>=8.2.0,<8.3.0|>=8.3.0,<8.4.0|>=8.4.0,<8.5.0|>=8.5.0,<8.6.0|>=8.6.0,<8.7.0|>=8.7.0,<8.7.5

Reported by:
FriendsOfPHP/security-advisories