diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 566c975f04..0b587590c3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -487,6 +487,7 @@ jobs:
- sslyze
- test-scan
- trivy
+ - typo3scan
- wpscan
- zap
diff --git a/scanners/typo3scan/.helm-docs.gotmpl b/scanners/typo3scan/.helm-docs.gotmpl
new file mode 100644
index 0000000000..535bd662b9
--- /dev/null
+++ b/scanners/typo3scan/.helm-docs.gotmpl
@@ -0,0 +1,50 @@
+{{- /*
+SPDX-FileCopyrightText: 2021 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+*/ -}}
+
+{{- define "extra.docsSection" -}}
+---
+title: "Typo3Scan"
+category: "scanner"
+type: "Network"
+state: "released"
+appVersion: "{{ template "chart.appVersion" . }}"
+usecase: "Automation of the process of detecting the Typo3 CMS and its installed extensions"
+---
+{{- end }}
+
+{{- define "extra.dockerDeploymentSection" -}}
+## Supported Tags
+- `latest` (represents the latest stable release build)
+- tagged releases, e.g. `{{ template "chart.appVersion" . }}`
+{{- end }}
+
+{{- define "extra.chartAboutSection" -}}
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+{{- end }}
+
+{{- define "extra.scannerConfigurationSection" -}}
+## Scanner Configuration
+
+The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range.
+
+Additional Typo3Scan scan features can be configured via the parameter attribute.
+
+Some useful example parameters listed below:
+
+- `--vuln` : Check for extensions with known vulnerabilities only.
+- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds
+- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization.
+- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies.
+- `--agent USER-AGENT`: Set custom User-Agent for requests.
+- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5
+- `--json`: Output results to json file
+- `--force`: Force enumeration
+- `--no-interaction`: Do not ask any interactive question
+
+{{- end }}
\ No newline at end of file
diff --git a/scanners/typo3scan/.helmignore b/scanners/typo3scan/.helmignore
new file mode 100644
index 0000000000..30a540feb0
--- /dev/null
+++ b/scanners/typo3scan/.helmignore
@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml
new file mode 100644
index 0000000000..8d1ccc0829
--- /dev/null
+++ b/scanners/typo3scan/Chart.yaml
@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+apiVersion: v2
+name: typo3scan
+description: A Helm chart for the Typo3 security scanner that integrates with the secureCodeBox
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
+version: v3.1.0-alpha1
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "0.7.2"
+kubeVersion: ">=v1.11.0-0"
+keywords:
+ - security
+ - typo3scan
+ - typo3
+ - scanner
+ - secureCodeBox
+
+home: https://docs.securecodebox.io/docs/scanners/typo3scan
+icon: https://docs.securecodebox.io/img/integrationIcons/Default.svg
+
+sources:
+ - https://github.com/secureCodeBox/secureCodeBox
+
+maintainers:
+ - name: iteratec GmbH
+ - email: secureCodeBox@iteratec.com
diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md
new file mode 100644
index 0000000000..a2da717e4c
--- /dev/null
+++ b/scanners/typo3scan/README.md
@@ -0,0 +1,70 @@
+---
+title: "Typo3Scan"
+category: "scanner"
+type: "Network"
+state: "released"
+appVersion: "0.7.2"
+usecase: "Automation of the process of detecting the Typo3 CMS and its installed extensions"
+---
+
+
+
+
+
+ 
+ 
+ 
+ 
+ 
+ 
+
+
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+
+## Deployment
+The typo3scan chart can be deployed via helm:
+
+```bash
+# Install HelmChart (use -n to configure another namespace)
+helm upgrade --install typo3scan secureCodeBox/typo3scan
+```
+
+## Scanner Configuration
+
+The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range.
+
+Additional Typo3Scan scan features can be configured via the parameter attribute.
+
+Some useful example parameters listed below:
+
+- `--vuln` : Check for extensions with known vulnerabilities only.
+- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds
+- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization.
+- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies.
+- `--agent USER-AGENT`: Set custom User-Agent for requests.
+- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5
+- `--json`: Output results to json file
+- `--force`: Force enumeration
+- `--no-interaction`: Do not ask any interactive question
+
+## Requirements
+
+Kubernetes: `>=v1.11.0-0`
+
diff --git a/scanners/typo3scan/docs/.gitkeep b/scanners/typo3scan/docs/.gitkeep
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/scanners/typo3scan/docs/README.ArtifactHub.md b/scanners/typo3scan/docs/README.ArtifactHub.md
new file mode 100644
index 0000000000..40f995091a
--- /dev/null
+++ b/scanners/typo3scan/docs/README.ArtifactHub.md
@@ -0,0 +1,77 @@
+
+
+
+
+
+
+
+
+
+
+
+
+## What is OWASP secureCodeBox?
+
+
+ 
+
+
+_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios.
+
+With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues.
+
+The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure.
+
+### Quickstart with secureCodeBox on kubernetes
+
+You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it.
+
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+
+## Deployment
+The typo3scan chart can be deployed via helm:
+
+```bash
+# Install HelmChart (use -n to configure another namespace)
+helm upgrade --install typo3scan secureCodeBox/typo3scan
+```
+
+## Scanner Configuration
+
+The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range.
+
+Additional Typo3Scan scan features can be configured via the parameter attribute.
+
+Some useful example parameters listed below:
+
+- `--vuln` : Check for extensions with known vulnerabilities only.
+- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds
+- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization.
+- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies.
+- `--agent USER-AGENT`: Set custom User-Agent for requests.
+- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5
+- `--json`: Output results to json file
+- `--force`: Force enumeration
+- `--no-interaction`: Do not ask any interactive question
+
+## Requirements
+
+Kubernetes: `>=v1.11.0-0`
+
diff --git a/scanners/typo3scan/docs/README.DockerHub-Parser.md b/scanners/typo3scan/docs/README.DockerHub-Parser.md
new file mode 100644
index 0000000000..4821c2dd4d
--- /dev/null
+++ b/scanners/typo3scan/docs/README.DockerHub-Parser.md
@@ -0,0 +1,82 @@
+
+
+
+
+
+
+
+
+
+
+
+
+## What is OWASP secureCodeBox?
+
+
+
+
+
+_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios.
+
+With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues.
+
+The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure.
+
+### Quickstart with secureCodeBox on kubernetes
+
+You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it.
+
+## Supported Tags
+- `latest` (represents the latest stable release build)
+- tagged releases, e.g. `0.7.2`
+
+## How to use this image
+This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://docs.securecodebox.io/docs/scanners/typo3scan.
+
+```bash
+docker pull securecodebox/parser-typo3scan
+```
+
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+
+## Community
+
+You are welcome, please join us on... 👋
+
+- [GitHub][scb-github]
+- [Slack][scb-slack]
+- [Twitter][scb-twitter]
+
+secureCodeBox is an official [OWASP][scb-owasp] project.
+
+## License
+[](https://opensource.org/licenses/Apache-2.0)
+
+As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
+
+As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
+
+[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox
+[scb-docs]: https://docs.securecodebox.io/
+[scb-site]: https://www.securecodebox.io/
+[scb-github]: https://github.com/secureCodeBox/
+[scb-twitter]: https://twitter.com/secureCodeBox
+[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU
+[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE
diff --git a/scanners/typo3scan/docs/README.DockerHub-Scanner.md b/scanners/typo3scan/docs/README.DockerHub-Scanner.md
new file mode 100644
index 0000000000..192b44220e
--- /dev/null
+++ b/scanners/typo3scan/docs/README.DockerHub-Scanner.md
@@ -0,0 +1,100 @@
+
+
+
+
+
+
+
+
+
+
+
+
+## What is OWASP secureCodeBox?
+
+
+
+
+
+_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios.
+
+With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues.
+
+The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure.
+
+### Quickstart with secureCodeBox on kubernetes
+
+You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it.
+
+## Supported Tags
+- `latest` (represents the latest stable release build)
+- tagged releases, e.g. `0.7.2`
+
+## How to use this image
+This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][https://docs.securecodebox.io/docs/scanners/typo3scan].
+
+```bash
+docker pull securecodebox/scanner-typo3scan
+```
+
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+
+## Scanner Configuration
+
+The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range.
+
+Additional Typo3Scan scan features can be configured via the parameter attribute.
+
+Some useful example parameters listed below:
+
+- `--vuln` : Check for extensions with known vulnerabilities only.
+- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds
+- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization.
+- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies.
+- `--agent USER-AGENT`: Set custom User-Agent for requests.
+- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5
+- `--json`: Output results to json file
+- `--force`: Force enumeration
+- `--no-interaction`: Do not ask any interactive question
+
+## Community
+
+You are welcome, please join us on... 👋
+
+- [GitHub][scb-github]
+- [Slack][scb-slack]
+- [Twitter][scb-twitter]
+
+secureCodeBox is an official [OWASP][scb-owasp] project.
+
+## License
+[](https://opensource.org/licenses/Apache-2.0)
+
+As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
+
+As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
+
+[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox
+[scb-docs]: https://docs.securecodebox.io/
+[scb-site]: https://www.securecodebox.io/
+[scb-github]: https://github.com/secureCodeBox/
+[scb-twitter]: https://twitter.com/secureCodeBox
+[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU
+[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE
diff --git a/scanners/typo3scan/examples/example.com/scan.yaml b/scanners/typo3scan/examples/example.com/scan.yaml
new file mode 100644
index 0000000000..fb57aff121
--- /dev/null
+++ b/scanners/typo3scan/examples/example.com/scan.yaml
@@ -0,0 +1,17 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+apiVersion: "execution.securecodebox.io/v1"
+kind: Scan
+metadata:
+ name: typo3scan-example
+spec:
+ scanType: "typo3scan"
+ parameters:
+ - "-d"
+ - "https://www.typo3.example.com" # Change to the website you want to scan
+ # Only show vulnerable extensions
+ - "--vuln"
+ # Set the number of threads to use for enumerating extensions at 10
+ - "--threads"
+ - "10"
\ No newline at end of file
diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile
new file mode 100644
index 0000000000..325a60fddf
--- /dev/null
+++ b/scanners/typo3scan/parser/Dockerfile
@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+ARG namespace
+ARG baseImageTag
+FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest}
+WORKDIR /home/app/parser-wrapper/parser/
+COPY --chown=app:app ./parser.js ./parser.js
\ No newline at end of file
diff --git a/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap
new file mode 100644
index 0000000000..7dea4868d6
--- /dev/null
+++ b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap
@@ -0,0 +1,1713 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`parser parses large json result with vulnerable extensions successfully 1`] = `
+Array [
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-026",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-026",
+ "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-025",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-025",
+ "subcomponent": "Query Generator (ext:lowlevel)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type SQL Injection found",
+ "location": "http://localhost:80",
+ "name": "SQL Injection",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-024",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024",
+ "subcomponent": "Extension Manager (ext:extensionmanger)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Directory Traversal found",
+ "location": "http://localhost:80",
+ "name": "Directory Traversal",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-023",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-023",
+ "subcomponent": "Filelist Module (ext:filelist)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-022",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-022",
+ "subcomponent": "Link Handling (ext:core, ext:frontend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-021",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-021",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-020",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-020",
+ "subcomponent": "Backend & Core API (ext:backend, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-019",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-019",
+ "subcomponent": "Backend API (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution, Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution, Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-018",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-018",
+ "subcomponent": "Frontend Session Handling (ext:frontend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-015",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-015",
+ "subcomponent": "Link Handling (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.3.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-014",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-014",
+ "subcomponent": "Backend User Interface (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-013",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-013",
+ "subcomponent": "Fluid Engine (package typo3fluid/fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.24 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-012",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012",
+ "subcomponent": "Image Processing via ImageMagick (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.24 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-011",
+ "subcomponent": "User Session Handling (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.24 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-008",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-008",
+ "subcomponent": "File List (ext:filelist)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-007",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-007",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-006",
+ "subcomponent": "3rd party library Bootstrap CSS toolkit",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-005",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-005",
+ "subcomponent": "Fluid (ext:fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-003",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-003",
+ "subcomponent": "Localization Handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Broken Access Control found",
+ "location": "http://localhost:80",
+ "name": "Broken Access Control",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-002",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-002",
+ "subcomponent": "Backend User Account Model (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-001",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-001",
+ "subcomponent": "RequireJS package configuration",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-012",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-012",
+ "subcomponent": "Frontend Session Handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Denial of Service found",
+ "location": "http://localhost:80",
+ "name": "Denial of Service",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-011",
+ "subcomponent": "Online media asset handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Denial of Service found",
+ "location": "http://localhost:80",
+ "name": "Denial of Service",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-010",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-010",
+ "subcomponent": "Install Tool",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-009",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-009",
+ "subcomponent": "Install Tool Session Handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-008",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-008",
+ "subcomponent": "Frontend user login",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-007",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-007",
+ "subcomponent": "Backend modal component",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-006",
+ "subcomponent": "Online media asset rendering",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-005",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-005",
+ "subcomponent": "3rd party JavaScript library CKEditor",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-004",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-004",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-003",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-003",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Privilege Escalation & SQL Injection found",
+ "location": "http://localhost:80",
+ "name": "Privilege Escalation & SQL Injection",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-002",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-002",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization & Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization & Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-001",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-001",
+ "subcomponent": "Salted Passwords (ext:saltedpasswords)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Authentication Bypass found",
+ "location": "http://localhost:80",
+ "name": "Authentication Bypass",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-007",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-007",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-005",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-005",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-006",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-004",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-004",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2020-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-011",
+ "subcomponent": "Session Storage (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.37 - 8.7.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Sensitive Data Exposure found",
+ "location": "http://localhost:80",
+ "name": "Sensitive Data Exposure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2020-010",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-010",
+ "subcomponent": "Fluid (ext:fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.37 - 8.7.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2020-009",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-009",
+ "subcomponent": "Fluid Engine (package typo3fluid/fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.37 - 8.7.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-008",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-008",
+ "subcomponent": "Content Preview Renderer (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-006",
+ "subcomponent": "Session Storage (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Sensitive Data Exposure found",
+ "location": "http://localhost:80",
+ "name": "Sensitive Data Exposure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-003",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-003",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Broken Access Control found",
+ "location": "http://localhost:80",
+ "name": "Broken Access Control",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-002",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-002",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Unrestricted File Upload found",
+ "location": "http://localhost:80",
+ "name": "Unrestricted File Upload",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-001",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-001",
+ "subcomponent": "Login Handling (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Open Redirection found",
+ "location": "http://localhost:80",
+ "name": "Open Redirection",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-013",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-013",
+ "subcomponent": "Content Rendering, HTML Parser (ext:frontend, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.41 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site-Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site-Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-012",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-012",
+ "subcomponent": "User Authentication (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.40 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-011",
+ "subcomponent": "Backend Grid View (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.40 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-010",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-010",
+ "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.40 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/extbase",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension extbase (Log4Php) found",
+ "location": "http://localhost:80/typo3/sysext/extbase/",
+ "name": "extbase",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/feedit",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension feedit (Frontend Editing) found",
+ "location": "http://localhost:80/typo3/sysext/feedit/",
+ "name": "feedit",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/func",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension func (WebFunc) found",
+ "location": "http://localhost:80/typo3/sysext/func/",
+ "name": "func",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/rsaauth",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension rsaauth (RSA authentication for TYPO3) found",
+ "location": "http://localhost:80/typo3/sysext/rsaauth/",
+ "name": "rsaauth",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/sys_action",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension sys_action (UserTask Center, Actions) found",
+ "location": "http://localhost:80/typo3/sysext/sys_action/",
+ "name": "sys_action",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/taskcenter",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension taskcenter (UserTask Center) found",
+ "location": "http://localhost:80/typo3/sysext/taskcenter/",
+ "name": "taskcenter",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/tstemplate",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [
+ Object {
+ "Current": "stable",
+ "Name": "news",
+ "Repo": "https://extensions.typo3.org/extension/news",
+ "Title": "News system",
+ "Url": "http://localhost:80/typo3/sysext/news/",
+ "Version": "3.1.0",
+ "Version File": "http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml",
+ "Vulnerabilities": Array [
+ Object {
+ "Advisory": "TYPO3-EXT-SA-2017-001",
+ "Affected": "3.2.6 - 0.0.0",
+ "Vulnerability Type": "SQL Injection",
+ },
+ Object {
+ "Advisory": "TYPO3-EXT-SA-2015-017",
+ "Affected": "3.2.1 - 0.0.0",
+ "Vulnerability Type": "Cross-Site Scripting",
+ },
+ ],
+ },
+ ],
+ },
+ "category": "Extension",
+ "description": "Extension tstemplate (WebTemplate) found",
+ "location": "http://localhost:80/typo3/sysext/tstemplate/",
+ "name": "tstemplate",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+]
+`;
+
+exports[`parser parses large json result without vulnerable extensions successfully 1`] = `
+Array [
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-026",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-026",
+ "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-025",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-025",
+ "subcomponent": "Query Generator (ext:lowlevel)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type SQL Injection found",
+ "location": "http://localhost:80",
+ "name": "SQL Injection",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-024",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024",
+ "subcomponent": "Extension Manager (ext:extensionmanger)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Directory Traversal found",
+ "location": "http://localhost:80",
+ "name": "Directory Traversal",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-023",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-023",
+ "subcomponent": "Filelist Module (ext:filelist)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-022",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-022",
+ "subcomponent": "Link Handling (ext:core, ext:frontend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-021",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-021",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.29 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-020",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-020",
+ "subcomponent": "Backend & Core API (ext:backend, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-019",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-019",
+ "subcomponent": "Backend API (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution, Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution, Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-018",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-018",
+ "subcomponent": "Frontend Session Handling (ext:frontend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-015",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-015",
+ "subcomponent": "Link Handling (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.3.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-014",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-014",
+ "subcomponent": "Backend User Interface (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.26 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-013",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-013",
+ "subcomponent": "Fluid Engine (package typo3fluid/fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.24 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-012",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012",
+ "subcomponent": "Image Processing via ImageMagick (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.24 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-011",
+ "subcomponent": "User Session Handling (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.24 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-008",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-008",
+ "subcomponent": "File List (ext:filelist)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-007",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-007",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-006",
+ "subcomponent": "3rd party library Bootstrap CSS toolkit",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-005",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-005",
+ "subcomponent": "Fluid (ext:fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-003",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-003",
+ "subcomponent": "Localization Handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Broken Access Control found",
+ "location": "http://localhost:80",
+ "name": "Broken Access Control",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-002",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-002",
+ "subcomponent": "Backend User Account Model (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2019-001",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-001",
+ "subcomponent": "RequireJS package configuration",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.22 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-012",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-012",
+ "subcomponent": "Frontend Session Handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Denial of Service found",
+ "location": "http://localhost:80",
+ "name": "Denial of Service",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-011",
+ "subcomponent": "Online media asset handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Denial of Service found",
+ "location": "http://localhost:80",
+ "name": "Denial of Service",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-010",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-010",
+ "subcomponent": "Install Tool",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-009",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-009",
+ "subcomponent": "Install Tool Session Handling",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Security Misconfiguration found",
+ "location": "http://localhost:80",
+ "name": "Security Misconfiguration",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-008",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-008",
+ "subcomponent": "Frontend user login",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-007",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-007",
+ "subcomponent": "Backend modal component",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-006",
+ "subcomponent": "Online media asset rendering",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-005",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-005",
+ "subcomponent": "3rd party JavaScript library CKEditor",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.20 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-004",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-004",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-003",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-003",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.5.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Privilege Escalation & SQL Injection found",
+ "location": "http://localhost:80",
+ "name": "Privilege Escalation & SQL Injection",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-002",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-002",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Insecure Deserialization & Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Insecure Deserialization & Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2018-001",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-001",
+ "subcomponent": "Salted Passwords (ext:saltedpasswords)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.16 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Authentication Bypass found",
+ "location": "http://localhost:80",
+ "name": "Authentication Bypass",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-007",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-007",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Arbitrary Code Execution found",
+ "location": "http://localhost:80",
+ "name": "Arbitrary Code Execution",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-005",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-005",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-006",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2017-004",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-004",
+ "subcomponent": "TYPO3 CMS",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.4 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2020-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-011",
+ "subcomponent": "Session Storage (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.37 - 8.7.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Sensitive Data Exposure found",
+ "location": "http://localhost:80",
+ "name": "Sensitive Data Exposure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2020-010",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-010",
+ "subcomponent": "Fluid (ext:fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.37 - 8.7.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2020-009",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-009",
+ "subcomponent": "Fluid Engine (package typo3fluid/fluid)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.37 - 8.7.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-008",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-008",
+ "subcomponent": "Content Preview Renderer (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-006",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-006",
+ "subcomponent": "Session Storage (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Sensitive Data Exposure found",
+ "location": "http://localhost:80",
+ "name": "Sensitive Data Exposure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-003",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-003",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Broken Access Control found",
+ "location": "http://localhost:80",
+ "name": "Broken Access Control",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-002",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-002",
+ "subcomponent": "Form Framework (ext:form)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Unrestricted File Upload found",
+ "location": "http://localhost:80",
+ "name": "Unrestricted File Upload",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-001",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-001",
+ "subcomponent": "Login Handling (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.39 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Open Redirection found",
+ "location": "http://localhost:80",
+ "name": "Open Redirection",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-013",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-013",
+ "subcomponent": "Content Rendering, HTML Parser (ext:frontend, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.41 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site-Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site-Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-012",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-012",
+ "subcomponent": "User Authentication (ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.40 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Information Disclosure found",
+ "location": "http://localhost:80",
+ "name": "Information Disclosure",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-011",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-011",
+ "subcomponent": "Backend Grid View (ext:backend)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.40 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "advisory": "TYPO3-CORE-SA-2021-010",
+ "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-010",
+ "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)",
+ "typo3_version": "8.7",
+ "versions_affected": "8.7.40 - 8.0.0",
+ },
+ "category": "Vulnerability",
+ "description": "Vulnerability of type Cross-Site Scripting found",
+ "location": "http://localhost:80",
+ "name": "Cross-Site Scripting",
+ "osi_layer": "APPLICATION",
+ "severity": "HIGH",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/extbase",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension extbase (Log4Php) found",
+ "location": "http://localhost:80/typo3/sysext/extbase/",
+ "name": "extbase",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/feedit",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension feedit (Frontend Editing) found",
+ "location": "http://localhost:80/typo3/sysext/feedit/",
+ "name": "feedit",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/func",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension func (WebFunc) found",
+ "location": "http://localhost:80/typo3/sysext/func/",
+ "name": "func",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/rsaauth",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension rsaauth (RSA authentication for TYPO3) found",
+ "location": "http://localhost:80/typo3/sysext/rsaauth/",
+ "name": "rsaauth",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/sys_action",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension sys_action (UserTask Center, Actions) found",
+ "location": "http://localhost:80/typo3/sysext/sys_action/",
+ "name": "sys_action",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/taskcenter",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension taskcenter (UserTask Center) found",
+ "location": "http://localhost:80/typo3/sysext/taskcenter/",
+ "name": "taskcenter",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+ Object {
+ "attributes": Object {
+ "extension_Version": "unknown",
+ "repository": "https://extensions.typo3.org/extension/tstemplate",
+ "typo3_version": "8.7",
+ "version_file": "not found",
+ "vulnerabilities": Array [],
+ },
+ "category": "Extension",
+ "description": "Extension tstemplate (WebTemplate) found",
+ "location": "http://localhost:80/typo3/sysext/tstemplate/",
+ "name": "tstemplate",
+ "osi_layer": "APPLICATION",
+ "severity": "INFORMATIONAL",
+ },
+]
+`;
diff --git a/scanners/typo3scan/parser/__testFiles__/localhost.json b/scanners/typo3scan/parser/__testFiles__/localhost.json
new file mode 100644
index 0000000000..9f92b52f9b
--- /dev/null
+++ b/scanners/typo3scan/parser/__testFiles__/localhost.json
@@ -0,0 +1,437 @@
+{
+ "http://localhost:80":{
+ "Backend":"http://localhost:80/typo3/index.php",
+ "Version":"8.7",
+ "Vulnerabilities":[
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-026",
+ "Type":"Insecure Deserialization",
+ "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-026"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-025",
+ "Type":"SQL Injection",
+ "Subcomponent":"Query Generator (ext:lowlevel)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-025"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-024",
+ "Type":"Directory Traversal",
+ "Subcomponent":"Extension Manager (ext:extensionmanger)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-024"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-023",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Filelist Module (ext:filelist)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-023"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-022",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Link Handling (ext:core, ext:frontend)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-022"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-021",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-021"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-020",
+ "Type":"Insecure Deserialization",
+ "Subcomponent":"Backend & Core API (ext:backend, ext:core)",
+ "Affected":"8.7.26 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-020"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-019",
+ "Type":"Arbitrary Code Execution, Cross-Site Scripting",
+ "Subcomponent":"Backend API (ext:backend)",
+ "Affected":"8.7.26 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-019"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-018",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"Frontend Session Handling (ext:frontend)",
+ "Affected":"8.7.26 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-018"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-015",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Link Handling (ext:core)",
+ "Affected":"8.7.26 - 8.3.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-015"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-014",
+ "Type":"Information Disclosure",
+ "Subcomponent":"Backend User Interface (ext:backend)",
+ "Affected":"8.7.26 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-014"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-013",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid Engine (package typo3fluid/fluid)",
+ "Affected":"8.7.24 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-013"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-012",
+ "Type":"Arbitrary Code Execution",
+ "Subcomponent":"Image Processing via ImageMagick (ext:core)",
+ "Affected":"8.7.24 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-012"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-011",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"User Session Handling (ext:core)",
+ "Affected":"8.7.24 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-008",
+ "Type":"Arbitrary Code Execution",
+ "Subcomponent":"File List (ext:filelist)",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-008"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-007",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.22 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-007"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-006",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"3rd party library Bootstrap CSS toolkit",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-005",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid (ext:fluid)",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-005"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-003",
+ "Type":"Broken Access Control",
+ "Subcomponent":"Localization Handling",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-003"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-002",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"Backend User Account Model (ext:core)",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-002"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-001",
+ "Type":"Information Disclosure",
+ "Subcomponent":"RequireJS package configuration",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-001"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-012",
+ "Type":"Denial of Service",
+ "Subcomponent":"Frontend Session Handling",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-012"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-011",
+ "Type":"Denial of Service",
+ "Subcomponent":"Online media asset handling",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-010",
+ "Type":"Information Disclosure",
+ "Subcomponent":"Install Tool",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-010"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-009",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"Install Tool Session Handling",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-009"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-008",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Frontend user login",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-008"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-007",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Backend modal component",
+ "Affected":"8.7.20 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-007"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-006",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Online media asset rendering",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-005",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"3rd party JavaScript library CKEditor",
+ "Affected":"8.7.20 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-005"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-004",
+ "Type":"Insecure Deserialization",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.16 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-004"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-003",
+ "Type":"Privilege Escalation & SQL Injection",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.16 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-003"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-002",
+ "Type":"Insecure Deserialization & Arbitrary Code Execution",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.16 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-002"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-001",
+ "Type":"Authentication Bypass",
+ "Subcomponent":"Salted Passwords (ext:saltedpasswords)",
+ "Affected":"8.7.16 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-001"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-007",
+ "Type":"Arbitrary Code Execution",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-007"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-005",
+ "Type":"Information Disclosure",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-005"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-006",
+ "Type":"Information Disclosure",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-004",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-004"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2020-011",
+ "Type":"Sensitive Data Exposure",
+ "Subcomponent":"Session Storage (ext:core)",
+ "Affected":"8.7.37 - 8.7.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2020-010",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid (ext:fluid)",
+ "Affected":"8.7.37 - 8.7.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-010"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2020-009",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid Engine (package typo3fluid/fluid)",
+ "Affected":"8.7.37 - 8.7.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-009"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-008",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Content Preview Renderer (ext:backend)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-008"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-006",
+ "Type":"Sensitive Data Exposure",
+ "Subcomponent":"Session Storage (ext:core)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-003",
+ "Type":"Broken Access Control",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-003"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-002",
+ "Type":"Unrestricted File Upload",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-002"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-001",
+ "Type":"Open Redirection",
+ "Subcomponent":"Login Handling (ext:core)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-001"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-013",
+ "Type":"Cross-Site-Scripting",
+ "Subcomponent":"Content Rendering, HTML Parser (ext:frontend, ext:core)",
+ "Affected":"8.7.41 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-013"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-012",
+ "Type":"Information Disclosure",
+ "Subcomponent":"User Authentication (ext:core)",
+ "Affected":"8.7.40 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-012"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-011",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Backend Grid View (ext:backend)",
+ "Affected":"8.7.40 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-010",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)",
+ "Affected":"8.7.40 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-010"
+ }
+ ],
+ "Extensions":[
+ {
+ "Name":"extbase",
+ "Title":"Log4Php",
+ "Repo":"https://extensions.typo3.org/extension/extbase",
+ "Current":"1.1.1 (alpha)",
+ "Url":"http://localhost:80/typo3/sysext/extbase/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"feedit",
+ "Title":"Frontend Editing",
+ "Repo":"https://extensions.typo3.org/extension/feedit",
+ "Current":"10.0.2 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/feedit/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"func",
+ "Title":"WebFunc",
+ "Repo":"https://extensions.typo3.org/extension/func",
+ "Current":"9.0.1 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/func/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"rsaauth",
+ "Title":"RSA authentication for TYPO3",
+ "Repo":"https://extensions.typo3.org/extension/rsaauth",
+ "Current":"10.0.1 (deprecated)",
+ "Url":"http://localhost:80/typo3/sysext/rsaauth/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"sys_action",
+ "Title":"UserTask Center, Actions",
+ "Repo":"https://extensions.typo3.org/extension/sys_action",
+ "Current":"10.0.0 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/sys_action/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"taskcenter",
+ "Title":"UserTask Center",
+ "Repo":"https://extensions.typo3.org/extension/taskcenter",
+ "Current":"10.0.0 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/taskcenter/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"tstemplate",
+ "Title":"WebTemplate",
+ "Repo":"https://extensions.typo3.org/extension/tstemplate",
+ "Current":"0.0.5 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/tstemplate/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json b/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json
new file mode 100644
index 0000000000..003a8448d1
--- /dev/null
+++ b/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json
@@ -0,0 +1,457 @@
+{
+ "http://localhost:80":{
+ "Backend":"http://localhost:80/typo3/index.php",
+ "Version":"8.7",
+ "Vulnerabilities":[
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-026",
+ "Type":"Insecure Deserialization",
+ "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-026"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-025",
+ "Type":"SQL Injection",
+ "Subcomponent":"Query Generator (ext:lowlevel)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-025"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-024",
+ "Type":"Directory Traversal",
+ "Subcomponent":"Extension Manager (ext:extensionmanger)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-024"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-023",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Filelist Module (ext:filelist)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-023"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-022",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Link Handling (ext:core, ext:frontend)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-022"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-021",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.29 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-021"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-020",
+ "Type":"Insecure Deserialization",
+ "Subcomponent":"Backend & Core API (ext:backend, ext:core)",
+ "Affected":"8.7.26 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-020"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-019",
+ "Type":"Arbitrary Code Execution, Cross-Site Scripting",
+ "Subcomponent":"Backend API (ext:backend)",
+ "Affected":"8.7.26 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-019"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-018",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"Frontend Session Handling (ext:frontend)",
+ "Affected":"8.7.26 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-018"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-015",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Link Handling (ext:core)",
+ "Affected":"8.7.26 - 8.3.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-015"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-014",
+ "Type":"Information Disclosure",
+ "Subcomponent":"Backend User Interface (ext:backend)",
+ "Affected":"8.7.26 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-014"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-013",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid Engine (package typo3fluid/fluid)",
+ "Affected":"8.7.24 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-013"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-012",
+ "Type":"Arbitrary Code Execution",
+ "Subcomponent":"Image Processing via ImageMagick (ext:core)",
+ "Affected":"8.7.24 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-012"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-011",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"User Session Handling (ext:core)",
+ "Affected":"8.7.24 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-008",
+ "Type":"Arbitrary Code Execution",
+ "Subcomponent":"File List (ext:filelist)",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-008"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-007",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.22 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-007"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-006",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"3rd party library Bootstrap CSS toolkit",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-005",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid (ext:fluid)",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-005"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-003",
+ "Type":"Broken Access Control",
+ "Subcomponent":"Localization Handling",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-003"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-002",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"Backend User Account Model (ext:core)",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-002"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2019-001",
+ "Type":"Information Disclosure",
+ "Subcomponent":"RequireJS package configuration",
+ "Affected":"8.7.22 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-001"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-012",
+ "Type":"Denial of Service",
+ "Subcomponent":"Frontend Session Handling",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-012"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-011",
+ "Type":"Denial of Service",
+ "Subcomponent":"Online media asset handling",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-010",
+ "Type":"Information Disclosure",
+ "Subcomponent":"Install Tool",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-010"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-009",
+ "Type":"Security Misconfiguration",
+ "Subcomponent":"Install Tool Session Handling",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-009"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-008",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Frontend user login",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-008"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-007",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Backend modal component",
+ "Affected":"8.7.20 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-007"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-006",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Online media asset rendering",
+ "Affected":"8.7.20 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-005",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"3rd party JavaScript library CKEditor",
+ "Affected":"8.7.20 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-005"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-004",
+ "Type":"Insecure Deserialization",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.16 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-004"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-003",
+ "Type":"Privilege Escalation & SQL Injection",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.16 - 8.5.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-003"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-002",
+ "Type":"Insecure Deserialization & Arbitrary Code Execution",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.16 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-002"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2018-001",
+ "Type":"Authentication Bypass",
+ "Subcomponent":"Salted Passwords (ext:saltedpasswords)",
+ "Affected":"8.7.16 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-001"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-007",
+ "Type":"Arbitrary Code Execution",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-007"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-005",
+ "Type":"Information Disclosure",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-005"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-006",
+ "Type":"Information Disclosure",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2017-004",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"TYPO3 CMS",
+ "Affected":"8.7.4 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-004"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2020-011",
+ "Type":"Sensitive Data Exposure",
+ "Subcomponent":"Session Storage (ext:core)",
+ "Affected":"8.7.37 - 8.7.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2020-010",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid (ext:fluid)",
+ "Affected":"8.7.37 - 8.7.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-010"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2020-009",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Fluid Engine (package typo3fluid/fluid)",
+ "Affected":"8.7.37 - 8.7.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-009"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-008",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Content Preview Renderer (ext:backend)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-008"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-006",
+ "Type":"Sensitive Data Exposure",
+ "Subcomponent":"Session Storage (ext:core)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-006"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-003",
+ "Type":"Broken Access Control",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-003"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-002",
+ "Type":"Unrestricted File Upload",
+ "Subcomponent":"Form Framework (ext:form)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-002"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-001",
+ "Type":"Open Redirection",
+ "Subcomponent":"Login Handling (ext:core)",
+ "Affected":"8.7.39 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-001"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-013",
+ "Type":"Cross-Site-Scripting",
+ "Subcomponent":"Content Rendering, HTML Parser (ext:frontend, ext:core)",
+ "Affected":"8.7.41 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-013"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-012",
+ "Type":"Information Disclosure",
+ "Subcomponent":"User Authentication (ext:core)",
+ "Affected":"8.7.40 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-012"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-011",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Backend Grid View (ext:backend)",
+ "Affected":"8.7.40 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-011"
+ },
+ {
+ "Advisory":"TYPO3-CORE-SA-2021-010",
+ "Type":"Cross-Site Scripting",
+ "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)",
+ "Affected":"8.7.40 - 8.0.0",
+ "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-010"
+ }
+ ],
+ "Extensions":[
+ {
+ "Name":"extbase",
+ "Title":"Log4Php",
+ "Repo":"https://extensions.typo3.org/extension/extbase",
+ "Current":"1.1.1 (alpha)",
+ "Url":"http://localhost:80/typo3/sysext/extbase/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"feedit",
+ "Title":"Frontend Editing",
+ "Repo":"https://extensions.typo3.org/extension/feedit",
+ "Current":"10.0.2 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/feedit/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"func",
+ "Title":"WebFunc",
+ "Repo":"https://extensions.typo3.org/extension/func",
+ "Current":"9.0.1 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/func/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"rsaauth",
+ "Title":"RSA authentication for TYPO3",
+ "Repo":"https://extensions.typo3.org/extension/rsaauth",
+ "Current":"10.0.1 (deprecated)",
+ "Url":"http://localhost:80/typo3/sysext/rsaauth/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"sys_action",
+ "Title":"UserTask Center, Actions",
+ "Repo":"https://extensions.typo3.org/extension/sys_action",
+ "Current":"10.0.0 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/sys_action/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"taskcenter",
+ "Title":"UserTask Center",
+ "Repo":"https://extensions.typo3.org/extension/taskcenter",
+ "Current":"10.0.0 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/taskcenter/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+
+ ]
+ },
+ {
+ "Name":"tstemplate",
+ "Title":"WebTemplate",
+ "Repo":"https://extensions.typo3.org/extension/tstemplate",
+ "Current":"0.0.5 (stable)",
+ "Url":"http://localhost:80/typo3/sysext/tstemplate/",
+ "Version":"unknown",
+ "Version File":"not found",
+ "Vulnerabilities":[
+ {
+ "Name":"news",
+ "Title":"News system",
+ "Repo":"https://extensions.typo3.org/extension/news",
+ "Current":"stable",
+ "Url":"http://localhost:80/typo3/sysext/news/",
+ "Version":"3.1.0",
+ "Version File":"http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml",
+ "Vulnerabilities":[
+ {
+ "Advisory":"TYPO3-EXT-SA-2017-001",
+ "Vulnerability Type":"SQL Injection",
+ "Affected":"3.2.6 - 0.0.0"
+ },
+ {
+ "Advisory":"TYPO3-EXT-SA-2015-017",
+ "Vulnerability Type":"Cross-Site Scripting",
+ "Affected":"3.2.1 - 0.0.0"
+ }
+ ]
+ }
+ ]
+ }
+ ]
+ }
+ }
\ No newline at end of file
diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js
new file mode 100644
index 0000000000..87916ed93f
--- /dev/null
+++ b/scanners/typo3scan/parser/parser.js
@@ -0,0 +1,63 @@
+// SPDX-FileCopyrightText: 2021 iteratec GmbH
+//
+// SPDX-License-Identifier: Apache-2.0
+
+async function parse(findings) {
+ let results = []
+
+ Object.keys(findings).forEach(key => {
+ const domain = key;
+ const domain_findings = findings[domain]
+ const vulns = domain_findings.Vulnerabilities
+
+ // Parsing Vulnerabilities
+ const parsed_vulnerabilities = vulns.map((vuln) => {
+ return {
+ name: vuln.Type,
+ description: `Vulnerability of type ${vuln.Type} found`,
+ category: "Vulnerability",
+ location: domain,
+ osi_layer: "APPLICATION",
+ severity: "HIGH",
+ attributes: {
+ typo3_version: domain_findings.Version,
+ advisory: vuln.Advisory,
+ subcomponent: vuln.Subcomponent,
+ versions_affected: vuln.Affected,
+ advisory_url: vuln['Advisory URL'],
+
+ }
+ };
+ });
+ // Parsing Extenstions
+ const extensions = domain_findings.Extensions
+ const parsed_extensions = extensions.map((ext) => {
+
+ // Check if extension has vulnerabilities : if yes severity = HIGH
+ let severity = 'INFORMATIONAL'
+ if (ext.Vulnerabilities.length > 0) {
+ severity = 'HIGH'
+ }
+ return {
+ name: ext.Name,
+ description: `Extension ${ext.Name} (${ext.Title}) found`,
+ category: "Extension",
+ location: ext.Url,
+ osi_layer: "APPLICATION",
+ severity: severity,
+ attributes: {
+ typo3_version: domain_findings.Version,
+ repository: ext.Repo,
+ extension_Version: ext.Version,
+ version_file: ext['Version File'],
+ vulnerabilities: ext.Vulnerabilities
+ }
+ };
+ });
+
+ results = parsed_vulnerabilities.concat(parsed_extensions)
+
+ });
+ return results
+}
+module.exports.parse = parse;
\ No newline at end of file
diff --git a/scanners/typo3scan/parser/parser.test.js b/scanners/typo3scan/parser/parser.test.js
new file mode 100644
index 0000000000..23737e38d4
--- /dev/null
+++ b/scanners/typo3scan/parser/parser.test.js
@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: 2021 iteratec GmbH
+//
+// SPDX-License-Identifier: Apache-2.0
+
+const fs = require("fs");
+const util = require("util");
+
+const readFile = util.promisify(fs.readFile);
+
+const { parse } = require("./parser");
+
+const {
+ validateParser,
+} = require("@securecodebox/parser-sdk-nodejs/parser-utils");
+
+test("parser parses large json result without vulnerable extensions successfully", async () => {
+ const fileContent = await readFile(
+ __dirname + "/__testFiles__/localhost.json",
+ {
+ encoding: "utf8",
+ }
+ );
+
+ const findings = await parse(JSON.parse(fileContent));
+ await expect(validateParser(findings)).resolves.toBeUndefined();
+ expect(findings).toMatchSnapshot();
+});
+
+test("parser parses large json result with vulnerable extensions successfully", async () => {
+ const fileContent = await readFile(
+ __dirname + "/__testFiles__/localhost_vuln_extensions.json",
+ {
+ encoding: "utf8",
+ }
+ );
+
+ const findings = await parse(JSON.parse(fileContent));
+ await expect(validateParser(findings)).resolves.toBeUndefined();
+ expect(findings).toMatchSnapshot();
+});
\ No newline at end of file
diff --git a/scanners/typo3scan/scanner/Dockerfile b/scanners/typo3scan/scanner/Dockerfile
new file mode 100644
index 0000000000..4b8e7f0dfd
--- /dev/null
+++ b/scanners/typo3scan/scanner/Dockerfile
@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Base Image
+FROM python:3.9-alpine as base
+
+# Install git and Clone Repo
+RUN apk add git \
+ && git clone https://github.com/whoot/Typo3Scan.git \
+ && cd Typo3Scan \
+ && rm -r .git .github doc
+
+# Runtime Image
+FROM python:3.9-alpine as runtime
+
+# Create typo3scan user/group and give access
+RUN addgroup --system --gid 1001 typo3scan && adduser typo3scan --system --uid 1001 --ingroup typo3scan
+COPY --from=base --chown=1001:1001 /Typo3Scan /home/typo3scan/
+
+WORKDIR /home/typo3scan/
+
+# Install Typo3Scan python requirements
+RUN python3 -m pip install -r requirements.txt
+
+# Switch work dir to scb folder so that the results get written there, and its available for local docker runs.
+WORKDIR /home/securecodebox/
+
+USER 1001
+
+ENTRYPOINT [ "python3", "/home/typo3scan/typo3scan.py" ]
\ No newline at end of file
diff --git a/scanners/typo3scan/templates/cascading-rules.yaml b/scanners/typo3scan/templates/cascading-rules.yaml
new file mode 100644
index 0000000000..2c32ae28d4
--- /dev/null
+++ b/scanners/typo3scan/templates/cascading-rules.yaml
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+# We only want to import the default cascading rules if they are enabled
+{{ if .Values.cascadingRules.enabled }}
+{{ range $path, $_ := .Files.Glob "cascading-rules/*" }}
+# Include File
+{{ $.Files.Get $path }}
+# Separate multiple files
+---
+{{ end }}
+{{ end }}
\ No newline at end of file
diff --git a/scanners/typo3scan/templates/typ3scan-parse-definition.yaml b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml
new file mode 100644
index 0000000000..10f8c37285
--- /dev/null
+++ b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+apiVersion: execution.securecodebox.io/v1
+kind: ParseDefinition
+metadata:
+ name: typo3scan-json
+spec:
+ image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}"
+ ttlSecondsAfterFinished: {{ .Values.parser.ttlSecondsAfterFinished }}
+ env:
+ {{- toYaml .Values.parser.env | nindent 4 }}
\ No newline at end of file
diff --git a/scanners/typo3scan/templates/typo3scan-scan-type.yaml b/scanners/typo3scan/templates/typo3scan-scan-type.yaml
new file mode 100644
index 0000000000..c1b0a0ecb2
--- /dev/null
+++ b/scanners/typo3scan/templates/typo3scan-scan-type.yaml
@@ -0,0 +1,41 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+apiVersion: "execution.securecodebox.io/v1"
+kind: ScanType
+metadata:
+ name: "typo3scan"
+spec:
+ extractResults:
+ type: typo3scan-json
+ location: "/home/securecodebox/typo3scan.json"
+ jobTemplate:
+ spec:
+ {{- if .Values.scanner.ttlSecondsAfterFinished }}
+ ttlSecondsAfterFinished: {{ .Values.scanner.ttlSecondsAfterFinished }}
+ {{- end }}
+ backoffLimit: {{ .Values.scanner.backoffLimit }}
+ template:
+ spec:
+ restartPolicy: Never
+ containers:
+ - name: typo3scan
+ image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
+ command:
+ - "python3"
+ - "/home/typo3scan/typo3scan.py"
+ - "--no-interaction"
+ - "--json"
+ resources:
+ {{- toYaml .Values.scanner.resources | nindent 16 }}
+ securityContext:
+ {{- toYaml .Values.scanner.securityContext | nindent 16 }}
+ env:
+ {{- toYaml .Values.scanner.env | nindent 16 }}
+ volumeMounts:
+ {{- toYaml .Values.scanner.extraVolumeMounts | nindent 16 }}
+ {{- if .Values.scanner.extraContainers }}
+ {{- toYaml .Values.scanner.extraContainers | nindent 12 }}
+ {{- end }}
+ volumes:
+ {{- toYaml .Values.scanner.extraVolumes | nindent 12 }}
diff --git a/scanners/typo3scan/values.yaml b/scanners/typo3scan/values.yaml
new file mode 100644
index 0000000000..2f795f7f99
--- /dev/null
+++ b/scanners/typo3scan/values.yaml
@@ -0,0 +1,60 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+parser:
+ image:
+ # parser.image.repository -- Parser image repository
+ repository: docker.io/securecodebox/parser-typo3scan
+ # parser.image.tag -- Parser image tag
+ # @default -- defaults to the charts version
+ tag: null
+ # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
+ ttlSecondsAfterFinished: null
+ # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
+ env: []
+
+scanner:
+ image:
+ # scanner.image.repository -- Container Image to run the scan
+ repository: docker.io/securecodebox/scanner-typo3scan
+ # scanner.image.tag -- defaults to the charts appVersion
+ tag: null
+
+ # scanner.nameAppend -- append a string to the default scantype name.
+ nameAppend: null
+
+ # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
+ ttlSecondsAfterFinished: null
+ # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy)
+ # @default -- 3
+ backoffLimit: 3
+
+ # scanner.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
+ resources: {}
+ # resources:
+ # requests:
+ # memory: "256Mi"
+ # cpu: "250m"
+ # limits:
+ # memory: "512Mi"
+ # cpu: "500m"
+
+ # scanner.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
+ env: []
+
+ # scanner.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
+ extraVolumes: []
+
+ # scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
+ extraVolumeMounts: []
+
+ # scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
+ extraContainers: []
+
+ # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+ securityContext: {}
+
+cascadingRules:
+ # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner
+ enabled: true