Tendenci 12.3.1 - CSV/ Formula Injection

Exploit Title: Tendenci 12.3.1 - CSV/ Formula Injection Date: 2020-10-29 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://www.tendenci.com/ Software Link: https://github.com/tendenci/tendenci Version: 12.3.1 Payload: =10+20+cmd|' /C calc'!A0 Tested on: Kali Linux 2020.3 Proof Of...

CVE-2020-4627

IBM Cloud Pak for Security 1.3.0.1CP4S potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367...

Input validation

IBM Cloud Pak for Security 1.3.0.1CP4S potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367...

CVE-2020-4627

IBM Cloud Pak for Security 1.3.0.1CP4S potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367...

CVE-2020-4627

CVE-2020-4627 affects IBM Cloud Pak for Security (CP4S) version 1.3.0.1, where a vulnerability in the handling/validation of CSV file contents could allow a remote attacker to execute arbitrary commands. The root cause is improper validation of CSV data leading to CVS Injection. The IBM security ...

CVE-2020-4627: Improper Neutralization of Formula Elements in a CSV File

IBM Cloud Pak for Security 1.3.0.1CP4S potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367...

CVE-2020-4627

IBM Cloud Pak for Security 1.3.0.1CP4S potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367...

CVE-2020-28845

A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system...

Design/Logic Flaw

A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system...

CVE-2020-28845

CVE-2020-28845 involves a CSV injection vulnerability in Netskope Admin portal (version 75.0). An unauthenticated attacker can inject a malicious payload via the admin UI, potentially compromising the administrator’s system. Metrics from NVD indicate high impact across confidentiality, integrity,...

CVE-2020-28845

A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system...

PT-2020-17042

Name of the Vulnerable Software and Affected Versions Netskope version 75.0 Description A CSV injection vulnerability in the Admin portal allows an unauthenticated user to inject a malicious payload, potentially compromising the admin's system. Recommendations For Netskope version 75.0, at the...

CVE-2020-28845: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system...

WordPress Easy Registration Forms plugin <= 2.0.6 - CSV Injection vulnerability

CSV Injection vulnerability found by Mohamad Pishdar cert.ikiu.ac.ir in WordPress Easy Registration Forms plugin versions = 2.0.6. Solution 2020-11-20 - we were unable to find information about the fix for this vulnerability...

WordPress Import and export users and customers plugin <= 1.16.3.5 - CSV Injection vulnerability

CSV Injection vulnerability found by Mohamad Pishdar cert.ikiu.ac.ir in WordPress Import and export users and customers plugin versions = 1.16.3.5. Solution Update the WordPress Import and export users and customers plugin to the latest available version at least 1.16.3.5...

WordPress weForms plugin <= 1.4.7 - CSV Injection vulnerability

CSV Injection vulnerability found by Mohamad Pishdar in WordPress weForms plugin versions = 1.4.7. Solution 2020-11-20 - we were unable to find information about the fix for this vulnerability...

Easy Registration Forms <= 2.0.6 - CSV Injection

Easy Registration Forms ER Forms Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable...

weForms < 1.6.4 - CSV Injection

The plugin allows CSV injection via a form's entry...

Import and export users and customers < 1.16.3.6 - CSV Injection

The plugin did not validate or sanitise user data, such as first and last names from the profile, leading to a CSV injection when the data is exported by an administrator...

SuiteCRM CSV Injection Vulnerability

SuiteCRM is a free open source customer relationship management application. A CSV injection vulnerability exists in SuiteCRM 7.11.13 and earlier versions. The vulnerability can be exploited to conduct CSV injection attacks via the registration field in the Accounts, Contacts, Opportunities, and...