CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36108 – Cross-Site Scripting in typo3/cms-core
https://notcve.org/view.php?id=CVE-2022-36108
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. TYPO3 es un sistema de administración de contenidos web de código abierto basado en PHP y publicado bajo la licencia GNU GPL. • https://github.com/TYPO3/typo3/commit/6863f73818c36b0b88c677ba533765c8074907b4 https://github.com/TYPO3/typo3/security/advisories/GHSA-fv2m-9249-qx85 https://typo3.org/security/advisory/typo3-core-sa-2022-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36020 – Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer
https://notcve.org/view.php?id=CVE-2022-36020
The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. • https://github.com/TYPO3/html-sanitizer/commit/60bfdc7f9b394d0236e16ee4cea8372a7defa493 https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-47m6-46mj-p235 https://packagist.org/packages/masterminds/html5 https://packagist.org/packages/typo3/html-sanitizer • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31050 – Insufficient Session Expiration in TYPO3 Admin Tool
https://notcve.org/view.php?id=CVE-2022-31050
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq https://typo3.org/security/advisory/typo3-core-sa-2022-005 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-31048 – Cross-Site Scripting in Form Framework
https://notcve.org/view.php?id=CVE-2022-31048
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0 https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg https://typo3.org/security/advisory/typo3-core-sa-2022-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31049 – Cross-Site Scripting in Frontend Login Mailer
https://notcve.org/view.php?id=CVE-2022-31049
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. TYPO3 es un sistema de administración de contenidos web de código abierto. • https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm https://typo3.org/security/advisory/typo3-core-sa-2022-004 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •