1669 matches found
Newsletter Plugin for WordPress < 6.8.2 Multiple Vulnerabilities
The WordPress Newsletter Plugin installed on the remote host is affected by an authenticated reflected Cross-Site Scripting XSS and a PHP object injection vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...
family-farm-newsletter-form.com Cross Site Scripting vulnerability OBB-1281549
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
email-newsletter-samples.com Cross Site Scripting vulnerability OBB-1279221
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
WordPress Newsletter Plugin Command Injection
A command injection vulnerability exists in WordPress Newsletter Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Threat Source newsletter for Aug. 13, 2020
Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. It’s really tough to attribute cyber attacks. We know it. You know it. But why is that, exactly? And why do we want to attribute attacks so badly anyway? In our latest blog post, we look at why attribution is challenging, and what...
WordPress Newsletter Plugin < 6.8.2 Multiple Vulnerabilities
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
Newsletter < 6.8.2 - Authenticated Cross-Site Scripting (XSS)
Newsletter suffers from an Authenticated Reflected Cross-Site ScriptingXSS vulnerability via the ‘tnpcrender’ AJAX action found in newsletter/emails/emails.php. Due to how the corresponding ‘tnpcrendercallback‘ function decodes input via the ‘restoreoptionsfromrequest’ function and renders them v...
Newsletter < 6.8.2 - Authenticated PHP Object Injection
The ‘restoreoptionsfromrequest‘ function called by the AJAX function ‘tnpcrendercallback‘ runs ‘unserialize’ directly on ‘$options'inlineedits'’ which is provided by user input in the $POST‘options’ parameter. This creates the potential for an Object Injection vulnerability. For example, a user...
WordPress Newsletter plugin <= 6.8.1 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by Ramuel Gall in WordPress Newsletter plugin versions = 6.8.1. Solution Update the WordPress Newsletter plugin to the latest available version at least 6.8.2...
Threat Source newsletter for July 16, 2020
Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. If you haven’t already, we highly recommend you read our in-depth research paper on election security. This paper represents four years of hands-on research, interviews and insight into how things have changed since 2016, and what...
SendPress Newsletter < 1.20.7.13 - Authenticated Stored Cross-Site Scripting (XSS)
Multiple Stored Cross-Site Scripting within SendPress Newsletter Settings due to improper input sanitation. The vulnerable fields are: - From Name - From Email - Where to send Test Email https://www.dropbox.com/s/slnc6oj1ryssvuz/sendpress-xss.mp4?dl=0 Payloads - v alert1337/// - v 1.20.7.13: "...
WordPress Newsletter plugin <= 6.7.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Chevon Phillip in WordPress Newsletter plugin versions = 6.7.6. Solution Update the WordPress Newsletter plugin to the latest available version at least 6.7.7...
Newsletter < 6.7.7 - Authenticated Stored Cross-Site Scripting
An Authenticated Stored Cross-Site Scripting XSS was discovered within the Company Info "Motto" field. When creating a new newsletter using an empty template with the header module, the XSS would execute. This was later fixed in version: 6.7.7...
Newsletter < 6.7.7 - Authenticated Stored Cross-Site Scripting
An Authenticated Stored Cross-Site Scripting XSS was discovered within the Company Info "Motto" field. When creating a new newsletter using an empty template with the header module, the XSS would execute. This was later fixed in version: 6.7.7 PoC...
Threat Source newsletter for June 25, 2020
Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We recently decided to replace our use of the terms "blacklist" and "whitelist" with "block list" and "allow list.” Even though these terms are commonly in use in the security industry, we will not go along with casually assigning...
Threat Source newsletter for June 4, 2020
Newsletter compiled by Jon Munshaw. Our social media content and promotion are on pause this week as there are more important issues being discussed and other voices that need to be heard. However, we still wanted to provide users with the latest IOCs and threats we’re seeing. Upcoming public...
Joomla Resources Directory (JRD) Portal Suffers Data Breach
Joomla, one of the most popular Open-source content management systems CMS, last week announced a new data breach impacting 2,700 users who have an account with its resources directory JRD website, i.e., resources.joomla.org. The breach exposed affected users' personal information, such as full...
CVE-2020-12700
The directmail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query...
