Information Disclosure

directmailteam/direct-mail is vulnerable to information disclosure. The extension fails to check if an authenticated backend user has access to pages with newsletter subscriber data when using the "Special query" feature...

Open Redirection

directmailteam/direct-mailis vulnerable to open redirection. The package does not sanitize jumpUrl allowing an attacker to redirect users to a malicious site...

Denial Of Service (DoS)

directmailteam/direct-mail is vulnerable to denial of service. An attacker is able to crash the system by requesting invalid or non-existing resources via HTTP which cause the system to call itself recursively...

TYPO3 Direct Mail Component Information Disclosure Vulnerability (CNVD-2020-28942)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and prior versions, which originates from the program's inability to check whether an authenticated back-end user...

CVE-2020-12697

The directmail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries...

CVE-2020-12700

The directmail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query...

CVE-2020-12698

The directmail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables...

CVE-2020-12699

The directmail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl...

CVE-2020-12700

The directmail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query...

CVE-2020-12698

The directmail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables...

TYPO3 Direct Mail Component Information Disclosure Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. direct Mail is an email marketing extension plugin used in it. An information disclosure vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and prior versions. The...

PT-2020-13211

Name of the Vulnerable Software and Affected Versions: direct mail extension for TYPO3 versions through 5.2.3 Description: The issue allows for Denial of Service via log entries. Recommendations: For versions through 5.2.3, update to a version later than 5.2.3 to resolve the issue...

TYPO3 Direct Mail Component Input Validation Error Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. direct Mail is an email marketing extension plugin used in it. A security vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and earlier versions, which stems from...

TYPO3 Direct Mail Component Denial of Service Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. direct Mail is an email marketing extension plugin used in it. A security vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and earlier versions. An attacker could...

Multiple vulnerabilities in extension "Direct Mail" (direct_mail)

Denial of Service CVE-2020-12697 The extension provides a functionality to log clicks on links in sent newsletters. This functionality does not limit the amount of log entries generated per link, so it is possible to use a valid link to fill the log table with a huge amount of records...

TYPO3 Direct Mail Information Disclosure Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. direct Mail is an email marketing extension plugin used in it. An information disclosure vulnerability exists in TYPO3 Direct Mail 5.2.2 and prior versions. The vulnerability ste...

CVE-2019-16698

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

Design/Logic Flaw

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

CVE-2019-16698

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

Information Disclosure in extension "Direct Mail" (direct_mail)

A missing access check in the backend module of the extension allows a backend user without access to configured tables e.g. feusers, ttaddress to view and export data of users subscribed to a newsletter...