CVE-2021-34658 Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site Scripting

The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7...

CVE-2021-34658

The CVE-2021-34658 entry corresponds to the WordPress plugin Simple Popup Newsletter (versions up to 1.4.7) and describes a Reflected Cross-Site Scripting (XSS) vulnerability caused by using $_SERVER['PHP_SELF'] in the file simple-popup-newsletter.php. Impact is injection of arbitrary web scripts...

CVE-2021-38302

The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection...

CVE-2021-38302

The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection...

Sql injection

The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection...

CVE-2021-38302

The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection...

CVE-2021-38302

CVE-2021-38302 affects the TYPO3 Newsletter extension (up to version 4.0.0). The vulnerability is a SQL Injection flaw arising in the extension, with multiple sources noting exploitation when processing bounced emails. Impact is high in affected environments, but official remediation details (spe...

Simple Popup Newsletter <= 1.4.7 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts...

WordPress Simple Popup Newsletter plugin <= 1.4.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Simple Popup Newsletter plugin versions = 1.4.7. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...

TYPO3 SQL Injection Vulnerability (CNVD-2022-17982)

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Typo3 association.TYPO3 Newsletter is vulnerable to SQL injection, which stems from vulnerability to SQL injection when processing returned emails. No detailed vulnerability details are currently...

Threat Source newsletter (Aug. 12, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. No, that's not Ratatouille. It's ServHelper, who is much more dangerous albeit just as cute as the cartoon chef. We have a new blog post out today detailing this RAT, run by the threat actor Group TA505, that is... This is only the...

SQL Injection in extension "Newsletter" (newsletter)

It has been discovered that the extension is susceptible to SQL Injection when processing bounced emails...

TYPO3 SQL注入漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Typo3 association.TYPO3 Newsletter is vulnerable to SQL injection, which stems from vulnerability to SQL injection when processing returned emails. No detailed vulnerability details are currently...

Unspecified Vulnerability in HCC Embedded InterNiche (CNVD-2021-59224)

HCC Embedded InterNiche is a newsletter software. A security vulnerability exists in the HCC Embedded InterNiche stack and NicheLite, which stems from the TFTP message processing feature that does not guarantee that filenames end in null, and can be exploited by an attacker to cause a denial of...

HCC Embedded InterNiche Buffer Overflow Vulnerability

HCC Embedded InterNiche is a newsletter software. A security vulnerability exists in HCC Embedded InterNiche, which can be exploited by attackers to cause read/write out of bounds...

Threat Source newsletter (Aug. 5, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. We hope everyone is enjoying BlackHat and/or DEFCON this week, regardless of if you're attending virtually or in person. In case you missed any of our talks from BlackHat, you can check them out here, along... This is only the...

HCC Embedded InterNiche 安全漏洞

HCC Embedded InterNiche is a newsletter software. A security vulnerability exists in HCC Embedded InterNiche, which stems from a TCP emergency data handling function that may call a panic function, which can be exploited by an attacker to cause an infinite loop...

HCC Embedded InterNiche 安全特征问题漏洞

HCC Embedded InterNiche is a newsletter software. An unspecified vulnerability exists in HCC Embedded InterNiche, which can be exploited to allow an attacker to be able to predict the source port of a DNS query, and then send spoofed DNS response packets that may be accepted as valid answers...

Threat Source newsletter (July 29, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. Thanks to everyone who joined us live yesterday for our talk on business email compromise. If you missed us live, the recording is up on our YouTube page now. Nick Biasini from Talos Outreach provided some great advice on... This i...

Information Disclosure

directmailteam/direct-mail is vulnerable to information disclosure. The extension fails to check if an authenticated backend user has access to pages with newsletter subscriber data when using the "Special query" feature...