{"kind": "product", "path": "vulns/packagist/typo3%2Fcms", "name": "typo3/cms", "product": "typo3/cms", "ecosystem": "Packagist", "items": [{"id": "GHSA-f3wf-q4fj-3gxf", "noindex": false, "published": "2024-06-07T19:56:24Z", "modified": "2024-12-04T05:40:10.455676Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-f3wf-q4fj-3gxf", "title": "TYPO3 Denial of Service in Online Media Asset Handling", "description": "Online Media Asset Handling (*`.youtube` and *`.vimeo` files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.", "references": ["https://github.com/TYPO3/typo3/commit/054799caf53b28ff92e00aff957fab88c45a7509", "https://github.com/TYPO3/typo3/commit/16567366e2a25c0cbed7208c3be9eda962e28c9b", "https://github.com/TYPO3/typo3/commit/7a5155e0137d01db7e5723849f0493ad5b0c98ac"], "fixes": ["7.6.32", "8.7.21", "9.5.2"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-6487-3qvg-8px9", "noindex": false, "published": "2024-06-07T19:55:04Z", "modified": "2024-12-04T05:43:43.805444Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-6487-3qvg-8px9", "title": "TYPO3 Information Disclosure in Install Tool", "description": "The Install Tool exposes the current TYPO3 version number to non-authenticated users.\n", "references": ["https://github.com/TYPO3/typo3/commit/232d0a64282382229c205904173a16a581555fe3", "https://github.com/TYPO3/typo3/commit/b4dd20f31d483f6399e8bcbffcac3e16a2df0d92", "https://github.com/TYPO3/typo3/commit/fab0cbc970b709ed65fc4622a2cbd52a197480c4"], "fixes": ["7.6.32", "8.7.21", "9.5.2"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-f777-f784-36gm", "noindex": false, "published": "2024-06-07T19:52:43Z", "modified": "2024-12-04T05:26:49.484217Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-f777-f784-36gm", "title": "TYPO3 Security Misconfiguration in Install Tool Cookie", "description": "It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.", "references": ["https://github.com/TYPO3/typo3/commit/13328b0f74ac589a20b021db814dfa672581c26a", "https://github.com/TYPO3/typo3/commit/918e50e4d20d88c7e40ad3bb134267d07706b0b1", "https://github.com/TYPO3/typo3/commit/a5359491e3fb3164a6ba96a66c8e67fbb9971a4c"], "fixes": ["7.6.32", "8.7.21", "9.5.2"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-2rcw-9hrm-8q7q", "noindex": false, "published": "2024-06-07T19:47:52Z", "modified": "2024-12-04T05:40:41.953716Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-2rcw-9hrm-8q7q", "title": "TYPO3 Cross-Site Scripting in Frontend User Login", "description": "Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.\n\nTemplate patterns that are affected are\n\n- ###FEUSER_[fieldName]### using system extension felogin\n- <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)", "references": ["https://github.com/TYPO3/typo3/commit/1c85fe70269e2ff8ecf0b6d5f16550c6cd0ddc78", "https://github.com/TYPO3/typo3/commit/373bec5d7d415f0764ebbadc7970610dc26da068", "https://github.com/TYPO3/typo3/commit/e4143195e1451630f058a58ab62d92135948a927"], "fixes": ["7.6.32", "8.7.21", "9.5.2"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-7q33-hxwj-7p8v", "noindex": false, "published": "2024-06-07T19:44:49Z", "modified": "2024-12-04T05:32:52.360263Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-7q33-hxwj-7p8v", "title": "TYPO3 Cross-Site Scripting in Backend Modal Component", "description": "Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.", "references": ["https://github.com/TYPO3/typo3/commit/02cd5c97228cba477d16c68e28309ce25c433ce9", "https://github.com/TYPO3/typo3/commit/89a38ad0ef9411745954f53f29bea5b8ce81cd32", "https://github.com/TYPO3/typo3/commit/c35646c3f7795a4a7b0046a88f146b490fa4883c"], "fixes": ["7.6.32", "8.7.21", "9.5.2"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-8m6j-p5jv-v69w", "noindex": false, "published": "2024-06-07T19:43:19Z", "modified": "2024-12-04T05:41:01.996060Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-8m6j-p5jv-v69w", "title": "TYPO3 Cross-Site Scripting in Online Media Asset Rendering", "description": "Failing to properly encode user input, online media asset rendering (`*.youtube` and `*.vimeo` files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.\n", "references": ["https://github.com/TYPO3/typo3/commit/20927adfb8aae0093508c904937e40114b92a90c", "https://github.com/TYPO3/typo3/commit/a32a9a746f807b14571139f0cb7caa00b8d037a5", "https://github.com/TYPO3/typo3/commit/c9174937802581bfecfaa788512a4f6e5cf8e9c7"], "fixes": ["7.6.32", "8.7.21", "9.5.2"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-8h4m-r4wm-xj7r", "noindex": false, "published": "2024-06-07T18:32:42Z", "modified": "2024-12-04T05:45:45.547191Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-8h4m-r4wm-xj7r", "title": "TYPO3 Arbitrary Code Execution via File List Module", "description": "Due to missing file extensions in $GLOBALS['TYPO3_CONF_VARS']['BE'][‘fileDenyPattern’], backend users are allowed to upload *.phar, *.shtml, *.pl or *.cgi files which can be executed in certain web server setups. A valid backend user account is needed in order to exploit this vulnerability.\n\nDerivatives of Debian GNU Linux are handling *.phar files as PHP applications since PHP 7.1 (for unofficial packages) and PHP 7.2 (for official packages).\n\nThe file extension *.shtml is bound to server side includes which are not enabled per default in most common Linux based distributions. File extension *.pl and *.cgi require additional handlers to be c", "references": ["https://github.com/TYPO3/typo3/commit/095ae4ab6869d0f7dc7befedb851cdd7ad0c7ebf", "https://github.com/TYPO3/typo3/commit/9990278ce7cf8e4d6b8bf31edec6787722d38b0f", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-7.yaml"], "fixes": ["8.7.23", "9.5.4"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-g585-crjf-vhwq", "noindex": false, "published": "2024-06-07T18:30:35Z", "modified": "2024-12-04T05:33:34.988912Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-g585-crjf-vhwq", "title": "TYPO3 Denial of Service in Frontend Record Registration", "description": "TYPO3’s built-in record registration functionality (aka `basic shopping cart`) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create  an arbitrary amount of individual session-data records in the database.", "references": ["https://github.com/TYPO3/typo3/commit/05011d1248c54d00960e344fd920a6246da92415", "https://github.com/TYPO3/typo3/commit/fc2b4b9fb978088267f83e73cd401d4371dd40e3", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-7.yaml"], "fixes": ["7.6.32", "8.7.21"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-f624-8hfq-5fh3", "noindex": false, "published": "2024-06-07T18:28:06Z", "modified": "2024-12-04T05:27:43.617176Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-f624-8hfq-5fh3", "title": "TYPO3 Information Disclosure of Installed Extensions", "description": "It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.", "references": ["https://github.com/TYPO3/typo3/commit/889ed77d2905d8b17afd31c723a23240c978823f", "https://github.com/TYPO3/typo3/commit/c81cca9e419e7aaed551b9b9a8d012ba7bffb287", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-1.yaml"], "fixes": ["8.7.23", "9.5.4"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-v8m4-3w37-ghxx", "noindex": false, "published": "2024-06-07T18:26:07Z", "modified": "2024-12-04T05:41:30.350747Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-v8m4-3w37-ghxx", "title": "TYPO3 Cross-Site Scripting in Form Framework validation handling", "description": "It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting.", "references": ["https://github.com/TYPO3/typo3/commit/966a0038c16c04d484c1703fba9fdc13f3e7a95c", "https://github.com/TYPO3/typo3/commit/9692bf83f8310cca17c9a968c4fe92ffe0deb59d", "https://github.com/TYPO3/typo3/commit/e971b012c837f1e64c1498b567ef6eec304febe5"], "fixes": ["10.2.1", "8.7.30", "9.5.12"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-4h5c-5g25-v7fh", "noindex": false, "published": "2024-06-07T18:24:43Z", "modified": "2024-12-04T05:40:09.928215Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-4h5c-5g25-v7fh", "title": "TYPO3 Cross-Site Scripting in Form Framework", "description": "Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting.", "references": ["https://github.com/TYPO3/typo3/commit/79528f75e23c2832db321f36d777c1427553f764", "https://github.com/TYPO3/typo3/commit/a0c4348188559596f292ea03983171bde29d9870", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-6.yaml"], "fixes": ["8.7.23", "9.5.4"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-c5mj-39cf-3pp5", "noindex": false, "published": "2024-06-07T17:19:38Z", "modified": "2024-12-04T05:37:52.473579Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-c5mj-39cf-3pp5", "title": "TYPO3 Security Misconfiguration for Backend User Accounts", "description": "When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in order to reflect changed configuration possibilities. However, this leads to persisting the current state as well, which can result into some of the following:\n\n- account contains empty login credentials (username and/or password)\n- account is incomplete and contains weak credentials (username and/or password)\n\nAlbeit the functionality provided by the TYP", "references": ["https://github.com/TYPO3/typo3/commit/b3608d14e1915030cde272000a247cb6d5f982b8", "https://github.com/TYPO3/typo3/commit/e4d0cff40a4f8f597e52c20fff529e206bb62703", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-2.yaml"], "fixes": ["8.7.23", "9.5.4"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-xgmx-j3hv-jh9x", "noindex": false, "published": "2024-06-07T17:16:53Z", "modified": "2024-12-04T05:39:14.563820Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-xgmx-j3hv-jh9x", "title": "TYPO3 Cross-Site Scripting in Link Handling", "description": "It has been discovered that `t3://` URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink.", "references": ["https://github.com/TYPO3/typo3/commit/25f796b94e23bac77e836bd38f53ce998c094901", "https://github.com/TYPO3/typo3/commit/64db88b9b61bb67b3b44145dc8e0e1ef251da45e", "https://github.com/TYPO3/typo3/commit/a35c42e9bcb020e16016d1c146354513a9856bc0"], "fixes": ["10.2.1", "8.7.30", "9.5.12"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-772m-43f3-hmf8", "noindex": false, "published": "2024-06-07T17:15:33Z", "modified": "2024-12-04T05:42:00.128871Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-772m-43f3-hmf8", "title": "TYPO3 Broken Access Control in Localization Handling", "description": "It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.", "references": ["https://github.com/TYPO3/typo3/commit/5004201ee77a69cb825637bc95cdeedb1186f4d4", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-3.yaml", "https://github.com/TYPO3/typo3"], "fixes": ["8.7.23"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-g7hw-jh4p-75wr", "noindex": false, "published": "2024-06-07T17:10:28Z", "modified": "2024-12-04T05:38:40.883875Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-g7hw-jh4p-75wr", "title": "TYPO3 Cross-Site Scripting in Filelist Module", "description": "It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences.\n\nAccess to the file system of the server - either directly or through synchronization - is required to exploit the vulnerability.", "references": ["https://github.com/TYPO3/typo3/commit/044d7dbe28382919c765b6b815d420f480a1ac70", "https://github.com/TYPO3/typo3/commit/96b122b756cc778697845d48210b0993c0724b5f", "https://github.com/TYPO3/typo3/commit/fcc1bab07027ba9d8140a91006d3cda1244d6298"], "fixes": ["10.2.1", "8.7.30", "9.5.12"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-85ch-44w7-rf32", "noindex": false, "published": "2024-06-07T17:08:39Z", "modified": "2024-12-04T05:31:26.997984Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-85ch-44w7-rf32", "title": "TYPO3 Cross-Site Scripting in Fluid ViewHelpers", "description": "Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting.", "references": ["https://github.com/TYPO3/typo3/commit/732c4acfaeaa7fd193674cd4d1ca7e369e21b96f", "https://github.com/TYPO3/typo3/commit/c94f566514eaff62dd836541c99b438ac55f6842", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-4.yaml"], "fixes": ["8.7.23", "9.5.4"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-hh95-5xm5-v8v7", "noindex": false, "published": "2024-06-07T17:07:03Z", "modified": "2024-12-04T05:40:21.293014Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-hh95-5xm5-v8v7", "title": "TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling", "description": "It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey as secret - invalid or unsigned payload is not deserialized.\n\nHowever, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly known and unprotected backup files), there is the possibility that attackers know the private encryptionKey and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized.\n\nRequirements for successfully exploiting this vulnerabilit", "references": ["https://github.com/TYPO3/typo3/commit/57e4ed35a6e58521a931855e702b2688b3bc3d62", "https://github.com/TYPO3/typo3/commit/b1626ad8fd4aebedc15e424a76f86094d78b2564", "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-12-17-7.yaml"], "fixes": ["8.7.30", "9.5.12"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}, {"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-259v-xm34-p7fr", "noindex": false, "published": "2024-06-05T17:23:19Z", "modified": "2024-12-02T05:48:35.164437Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-259v-xm34-p7fr", "title": "Typo3 Cross-Site Scripting in Language Pack Handling", "description": "Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting.", "references": ["https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-8.yaml", "https://github.com/TYPO3/typo3", "https://typo3.org/security/advisory/typo3-core-sa-2019-004"], "fixes": ["9.5.4"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-f5rr-9r84-wwqf", "noindex": false, "published": "2024-06-05T17:22:52Z", "modified": "2024-12-02T05:24:43.811268Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-f5rr-9r84-wwqf", "title": "Typo3 Broken Access Control in Import Module", "description": "It has been discovered that the Import/Export module is susceptible to broken access control. Regular backend users have access to import functionality which usually only is available to admin users or users having User TSconfig setting options.impexp.enableImportForNonAdminUser explicitly enabled.\n\nDatabase content to be imported however was correctly checked against users’ permissions and not affected. However it was possible to upload files by-passing restrictions of the file abstraction layer (FAL) - however this did not affect executable files which have been correctly secured by fileDenyPattern.\n\nCurrently the only known vulnerability i", "references": ["https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-06-25-7.yaml", "https://github.com/TYPO3/typo3", "https://typo3.org/security/advisory/typo3-core-sa-2019-017"], "fixes": ["9.5.8"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}, {"id": "GHSA-h934-f4m4-wc8x", "noindex": false, "published": "2024-06-05T17:21:19Z", "modified": "2024-12-02T05:41:25.328631Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-h934-f4m4-wc8x", "title": "Typo3 Information Disclosure in Page Tree", "description": "It has been discovered backend users not having read access to specific pages still could see them in the page tree which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.", "references": ["https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-05-07-4.yaml", "https://github.com/TYPO3/typo3", "https://typo3.org/security/advisory/typo3-core-sa-2019-009"], "fixes": ["9.5.6"], "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}]}], "total": 188, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 10, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "typo3/cms", "path": "vulns/packagist/typo3%2Fcms", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["12.1.1", "11.5.20", "11.5.16", "11.5.11", "11.5.0", "11.3.2", "11.3.1", "11.1.1", "10.4.33", "10.4.32", "10.4.29", "10.4.19"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2024-12-04T05:45:45.547191Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}