Security Advisories
All Advisories
TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing
It has been discovered that TYPO3 CMS is vulnerable to information disclosure.
TYPO3-CORE-SA-2022-006: Denial of Service in Page Error Handling
It has been discovered that TYPO3 CMS is susceptible to denial of service.
TYPO3-EXT-SA-2022-014: SQL Injection in extension "LUX - TYPO3 Marketing Automation" (lux)
It has been discovered that the extension "LUX - TYPO3 Marketing Automation" (lux) is susceptible to SQL Injection.
TYPO3-CORE-SA-2022-005: Insufficient Session Expiration in Admin Tool
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3-CORE-SA-2022-004: Cross-Site Scripting in Frontend Login Mailer
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.
TYPO3-CORE-SA-2022-003: Cross-Site Scripting in Form Framework
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.
TYPO3-CORE-SA-2022-002: Information Disclosure via Exception Handling/Logger
It has been discovered that TYPO3 CMS is susceptible to information disclosure.
TYPO3-CORE-SA-2022-001: Information Disclosure via Export Module
It has been discovered that TYPO3 CMS is susceptible to information disclosure.
TYPO3-EXT-SA-2022-013: Cross-Site Scripting in extension "AMEOS - TarteAuCitron (GDPR cookie banner and tracking management / French RGPD compatible)" (ameos_tarteaucitron)
It has been discovered that the extension "AMEOS - TarteAuCitron (GDPR cookie banner and tracking management / French RGPD compatible)"…
TYPO3-EXT-SA-2022-012: Cross-Site Scripting in extension "Embedding schema.org vocabulary" (schema)
It has been discovered that the extension "Embedding schema.org vocabulary" (schema) is susceptible to Cross-Site Scripting.
TYPO3-EXT-SA-2022-011: Cross-Site Scripting in extension "Matomo Integration" (matomo_integration)
It has been discovered that the extension "Matomo Integration" (matomo_integration) is susceptible to Cross-Site Scripting.
TYPO3-EXT-SA-2022-010: Cross-Site Scripting in extension "libconnect" (libconnect)
It has been discovered that the extension "libconnect" (libconnect) is susceptible to Cross-Site Scripting.
TYPO3-EXT-SA-2022-009: Cross-Site Scripting in extension "Grid Elements" (gridelements)
It has been discovered that the extension "Grid Elements" (gridelements) is susceptible to Cross-Site Scripting.
TYPO3-EXT-SA-2022-008: Multiple vulnerabilities in extension "Adminer" (t3adminer)
It has been discovered that the extension "Adminer" (t3adminer) is susceptible to Server-side request forgery and Cross-Site Scripting.
TYPO3-EXT-SA-2022-007: SQL Injection in extension "One is Enough Library" (oelib)
It has been discovered that the extension "One is Enough Library" (oelib) is susceptible to SQL Injection.
TYPO3-EXT-SA-2022-006: SQL Injection in extension "Seminar Manager" (seminars)
It has been discovered that the extension "Seminar Manager" (seminars) is susceptible to SQL Injection.
TYPO3-EXT-SA-2022-005: Remote Code Execution in extension "Job portal" (psvneo_jobfair)
It has been discovered that the extension "Job portal" (psvneo_jobfair) is susceptible to Remote Code Execution.
TYPO3-PSA-2022-001: Sanitization bypass in SVG Sanitizer
Third-party package enshrined/svg-sanitize, used by TYPO3 core packages, was susceptible to bypassing the sanitization strategy.
TYPO3-EXT-SA-2022-004: File Content Injection in extension "Hardcoded text to Locallang" (mqk_locallangtools)
It has been discovered that the extension "Hardcoded text to Locallang" (mqk_locallangtools) is susceptible to File Content Injection.
TYPO3-EXT-SA-2022-003: Insecure direct object reference in extension "Varnishcache" (varnishcache)
It has been discovered that the extension "Varnishcache" (varnishcache) is susceptible to Insecure direct object reference.