TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS)

Description

References

• nvd.nist.gov/vuln/detail/CVE-2009-4159 · ADVISORY
• kartolo/direct_mail · PACKAGE
• web.archive.org/web/20110108051351/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-018 · WEB
• web.archive.org/web/20200228220911/http://www.securityfocus.com/bid/37166 · WEB
• typo3.org/extensions/repository/view/direct_mail/2.6.5 · WEB
• secunia.com/advisories/37552 · Vendor Advisory
• typo3.org/extensions/repository/view/direct_mail/2.6.5 · Patch
• typo3.org/teams/security/security-bulletins/typo3-sa-2009-018 · Patch
• securityfocus.com/bid/37166

directmailteam/direct-mail 的其他漏洞

• CVE-2023-50461高危 8.8An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the exte…
• CVE-2020-12700中危 4.3The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
• CVE-2020-12699中危 6.1The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
• CVE-2020-12698中危 4.3The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
• CVE-2020-12697中危 5.3The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.