1669 matches found
Information disclosure
The directmail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query...
Improper access control
The directmail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables...
CVE-2020-12700
The directmail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query...
CVE-2020-12698
The Direct Mail extension for TYPO3 (direct_mail) up to version 5.2.3 has Broken Access Control affecting newsletter subscriber tables when exporting via CSV. The vulnerability arises from insufficient authorization checks for backend users accessing data (e.g., tt_address, fe_users) during CSV e...
CVE-2020-12698
The directmail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables...
Threat Source newsletter for April 23, 2020
Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. There’s a new Beers with Talos podcast out now. And guess what? They actually talk about security this time! The guys are looking for...
Newsletter < 6.5.4 - CSV Injection
A CSV Injection vulnerability was discovered in Wordpress Newsletter plugin. It allows a user with low level privileges or no privileges to inject a command in subscription form that will be included in the exported CSV file, leading to possible code execution...
CVE-2014-1634
SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/ancategoryid/ PATHINFO...
Sql injection
SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/ancategoryid/ PATHINFO...
CVE-2014-1634
The CVE-2014-1634 entry concerns the Magento extension Advanced Newsletter, vulnerable before version 2.3.5. The underlying issue is SQL Injection in the extension via the PATH_INFO endpoint /store/advancednewsletter/index/subscribeajax/an_category_id/. The CVSS 3.1 metrics show a CRITICAL base s...
CVE-2014-1634
SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/ancategoryid/ PATHINFO...
Threat Source newsletter (Feb. 20, 2020)
Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. We’ve got more ways than ever for you to get Talos content. We continue to grow our YouTube page with the second entry in the “Stories...
Threat Source newsletter (Jan. 30, 2020)
Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. Be sure to pay close attention Tuesday for some changes we have coming to Snort.org. We’ll spare you the details for now, but please bea...
Happy 10th Birthday, KrebsOnSecurity.com
Today marks the 10th anniversary of KrebsOnSecurity.com! Over the past decade, the site has featured more than 1,800 stories focusing mainly on cybercrime, computer security and user privacy concerns. And what a decade it has been. Stories here have exposed countless scams, data breaches,...
CVE-2019-8127
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a...
CVE-2019-8127
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a...
WordPress freshmail-newsletter plugin SQL injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. freshmail-newsletter is an email marketing and newsletter plugin used in it. A SQL injection vulnerability exists in WordPress...
CVE-2015-9496
The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FMform id=' substring...