CVE-2020-26216

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with...

CVE-2020-15241

TYPO3 Fluid Engine package "typo3fluid/fluid" before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like "showFullName ? fullName : defaultValue". Updated versions of this package ar...

CVE-2020-15241: URL Redirection to Untrusted Site

TYPO3 Fluid Engine package typo3fluid/fluid before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like showFullName ? fullName : defaultValue. Updated versions of this package are...

PT-2020-14306 · Typo3 · Typo3Fluid/Fluid

Name of the Vulnerable Software and Affected Versions: typo3fluid/fluid versions prior to 2.0.5 typo3fluid/fluid versions prior to 2.1.4 typo3fluid/fluid versions prior to 2.2.1 typo3fluid/fluid versions prior to 2.3.5 typo3fluid/fluid versions prior to 2.4.1 typo3fluid/fluid versions prior to...