typo3/cms Security Advisories for v8.7.15 (37)
-
[MEDIUM] Typo3 XSS Vulnerability
PKSA-j487-wgb6-g37w CVE-2018-6905 GHSA-3w22-wrwx-2r75
Affected version: <9.2.0
Reported by:
GitHub -
[HIGH] TYPO3-CORE-SA-2020-011: Cleartext storage of session identifier
PKSA-tb1c-8bnf-mvmf CVE-2020-26228 GHSA-954j-f27r-cj52
Affected version: >=10.0.0,<10.4.10|>=9.0.0,<9.5.23|>=8.7.0,<8.7.38
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] TYPO3-CORE-SA-2020-010: Cross-Site Scripting in Fluid view helpers
PKSA-7sv8-gd3z-zptc CVE-2020-26227 GHSA-vqqx-jw6p-q3rf
Affected version: >=10.0.0,<10.4.10|>=9.0.0,<9.5.23|>=8.7.0,<8.7.38
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Insecure Deserialization in Query Generator & Query View
PKSA-fyxc-qkr6-f3ry CVE-2019-19849
Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12
Reported by:
FriendsOfPHP/security-advisories -
SQL Injection in low-level Query Generator
PKSA-8qsb-zpqf-kwq2 CVE-2019-19850
Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12
Reported by:
FriendsOfPHP/security-advisories -
Directory Traversal on ZIP extraction
PKSA-187n-yk48-q1fv CVE-2019-19848
Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Form Framework validation handling
Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Link Handling
Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12
Reported by:
FriendsOfPHP/security-advisories -
Possible Insecure Deserialization in Extbase Request Handling
Affected version: >=8.0.0,<8.7.30|>=9.0.0,<9.5.12
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Filelist Module
Affected version: >=10.0.0,<10.2.1|>=8.0.0,<8.7.30|>=9.0.0,<9.5.12
Reported by:
FriendsOfPHP/security-advisories -
[HIGH] Insecure Deserialization in TYPO3 CMS
PKSA-bz6f-yjw4-93sv CVE-2019-12747 GHSA-86hp-xrhj-fhpq
Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] Cross-Site Scripting in Link Handling
PKSA-shfj-qhnv-r9fs CVE-2019-12748 GHSA-r6fv-56gp-j3r4
Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Security Misconfiguration in Frontend Session Handling
Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8
Reported by:
FriendsOfPHP/security-advisories -
Arbitrary Code Execution and Cross-Site Scripting in Backend API
Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8
Reported by:
FriendsOfPHP/security-advisories -
Information Disclosure in Backend User Interface
Affected version: >=8.0.0,<8.7.27|>=9.0.0,<9.5.8
Reported by:
FriendsOfPHP/security-advisories -
[HIGH] Possible Arbitrary Code Execution in Image Processing
PKSA-k6fx-zsn9-8q9f CVE-2019-11832 GHSA-3w4h-r27h-4r2w
Affected version: >=8.0.0,<8.7.25|>=9.0.0,<9.5.6
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] Cross-Site Scripting in Fluid Engine
PKSA-dmbp-4kzv-9s4r CVE-2020-15241 GHSA-7733-hjv6-4h47
Affected version: >=8.0.0,<8.7.25|>=9.0.0,<9.5.6
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Security Misconfiguration in User Session Handling
Affected version: >=8.0.0,<8.7.25|>=9.0.0,<9.5.6
Reported by:
FriendsOfPHP/security-advisories -
[MEDIUM] Cross-Site Scripting in Bootstrap CSS toolkit
PKSA-ww37-6vs7-z8br CVE-2018-14041 GHSA-pj7m-g53m-7638
Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Arbitrary Code Execution via File List Module
Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4
Reported by:
FriendsOfPHP/security-advisories -
Security Misconfiguration for Backend User Accounts
Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4
Reported by:
FriendsOfPHP/security-advisories -
Broken Access Control in Localization Handling
Affected version: >=8.0.0,<8.7.23
Reported by:
FriendsOfPHP/security-advisories -
Information Disclosure of Installed Extensions
Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Form Framework
Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Fluid ViewHelpers
Affected version: >=8.0.0,<8.7.23|>=9.0.0,<9.5.4
Reported by:
FriendsOfPHP/security-advisories -
[MEDIUM] Cross-Site Scripting in CKEditor
PKSA-qmq7-q129-2wts CVE-2018-17960 GHSA-g68x-vvqq-pvw3
Affected version: >=8.0.0,<8.7.21|>=9.0.0,<9.5.2
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Information Disclosure in Install Tool
Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2
Reported by:
FriendsOfPHP/security-advisories -
Denial of Service in Online Media Asset Handling
Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Online Media Asset Rendering
Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Backend Modal Component
Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2
Reported by:
FriendsOfPHP/security-advisories -
Denial of Service in Frontend Record Registration
Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21
Reported by:
FriendsOfPHP/security-advisories -
Security Misconfiguration in Install Tool Cookie
Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2
Reported by:
FriendsOfPHP/security-advisories -
Cross-Site Scripting in Frontend User Login
Affected version: >=7.0.0,<7.6.32|>=8.0.0,<8.7.21|>=9.0.0,<9.5.2
Reported by:
FriendsOfPHP/security-advisories -
Insecure Deserialization in TYPO3 CMS
Affected version: >=8.5.0,<8.7.17|>=9.0.0,<9.3.2
Reported by:
FriendsOfPHP/security-advisories -
Privilege Escalation & SQL Injection in TYPO3 CMS
Affected version: >=8.5.0,<8.7.17|>=9.0.0,<9.3.2
Reported by:
FriendsOfPHP/security-advisories -
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
Affected version: >=7.0.0,<7.6.30|>=8.0.0,<8.7.17|>=9.0.0,<9.3.2
Reported by:
FriendsOfPHP/security-advisories -
Authentication Bypass in TYPO3 CMS
Affected version: >=7.0.0,<7.6.30|>=8.0.0,<8.7.17|>=9.0.0,<9.3.2
Reported by:
FriendsOfPHP/security-advisories