Vulnerabilities > Typo3

DATE CVE VULNERABILITY TITLE RISK
2020-11-23 CVE-2020-26229 XXE vulnerability in Typo3
TYPO3 is an open source PHP based web content management system.
network
high complexity
typo3 CWE-611
3.6
2020-11-23 CVE-2020-26228 Cleartext Storage of Sensitive Information vulnerability in Typo3
TYPO3 is an open source PHP based web content management system.
network
low complexity
typo3 CWE-312
5.0
2020-11-23 CVE-2020-26227 Cross-Site Scripting vulnerability in Typo3
TYPO3 is an open source PHP based web content management system.
network
typo3 CWE-79
4.3
2020-11-17 CVE-2020-26216 Cross-Site Scripting vulnerability in Typo3 Fluid
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.
network
typo3 CWE-79
4.3
2020-10-08 CVE-2020-15241 Open Redirect vulnerability in Typo3 Fluid Engine and Typo3
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`.
network
typo3 CWE-601
4.3
2020-07-29 CVE-2020-15099 Improper Input Validation vulnerability in Typo3
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation.
network
typo3 CWE-20
6.8
2020-07-29 CVE-2020-15098 Deserialization of Untrusted Data vulnerability in Typo3
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums.
network
low complexity
typo3 CWE-502
6.5
2020-07-29 CVE-2020-15086 Deserialization of Untrusted Data vulnerability in Typo3 Mediace 7.6.2/7.6.3/7.6.4
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums.
network
low complexity
typo3 CWE-502
7.5
2020-05-14 CVE-2020-11069 Cross-Site Request Forgery (CSRF) vulnerability in Typo3
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery.
network
typo3 CWE-352
6.8
2020-05-14 CVE-2020-11067 Deserialization of Untrusted Data vulnerability in Typo3
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization.
network
typo3 CWE-502
6.0