Typo3 Html-Sanitizer vulnerabilities

CVE-2024-34078 [HIGH] Arbitrary HTML present after sanitization because of unicode normalization Arbitrary HTML present after sanitization because of unicode normalization ### Impact If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. ### Patches The problem has been fixed in 2.4.2. ### Workarounds Set `keep

CVE-2023-47125 [MEDIUM] CWE-79 CVE-2023-47125: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affec TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There

CVE-2023-38500 [MEDIUM] CWE-79 CVE-2023-38500: TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-sa TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded cor

CVE-2022-23499 [MEDIUM] CWE-79 CVE-2022-23499: HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing

CVE-2022-36020 [MEDIUM] CWE-79 CVE-2022-36020: The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe ma The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass