CVE-2020-12700

The CVE-2020-12700 issue affects TYPO3's Direct Mail extension (direct_mail), version up to 5.2.3. The root cause is a missing access check for an authenticated backend user when using the Special Query feature, which enables Information Disclosure of newsletter subscriber data. Documented impact...

CVE-2020-12699

The CVE-2020-12699 entry concerns the TYPO3 Direct Mail (direct_mail) extension up to version 5.2.3, where the jumpUrl parameter is not sanitized, enabling an Open Redirect. This conclusion is supported by multiple connected sources (Veracode, GHSA/OSV, CVE records) describing an Open Redirect vi...

CVE-2020-12699

The directmail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl...

CVE-2020-12698

The Direct Mail extension for TYPO3 (direct_mail) up to version 5.2.3 has Broken Access Control affecting newsletter subscriber tables when exporting via CSV. The vulnerability arises from insufficient authorization checks for backend users accessing data (e.g., tt_address, fe_users) during CSV e...

CVE-2020-12697

The CVE-2020-12697 entry affects the TYPO3 Direct Mail extension (direct_mail) up to version 5.2.3. Root cause: a logging mechanism for link clicks has no cap on log entry generation, enabling an attacker to cause excessive log writes and trigger a denial of service. Impact is described as DoS vi...

CVE-2020-12697

The directmail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries...

CVE-2020-12700: Missing Authorization

The directmail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query...

CVE-2020-12697: Allocation of Resources Without Limits or Throttling

The directmail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries...

CVE-2020-12698: Missing Authorization

The directmail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables...

CVE-2020-12699: URL Redirection to Untrusted Site

The directmail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl...

CVE-2019-16698

The CVE-2019-16698 issue affects the TYPO3 Direct Mail extension (direct_mail) up to version 5.2.2. A missing access check in the backend module allows a user with restricted permissions (to fe_users) to view and export data of frontend newsletter subscribers. The condition is an information-disc...

CVE-2019-16698: Missing Authorization

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...