Gophish CSV Injection Vulnerability

Gophish is a powerful open source phishing framework. A CSV injection vulnerability exists in Gophish versions prior to 0.11.0. No detailed vulnerability details are provided at this time...

CVE-2020-15255 CSV injection in Anuko Time Tracker

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software for example, when a cell value starts with an equal sign. This is fixed in version 1.19.23.5325...

Input validation

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

Design/Logic Flaw

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID:...

CVE-2020-4302

CVE-2020-4302 affects IBM Cognos Analytics 11.0 and 11.1 and is due to a CSV injection that could allow a remote attacker to execute arbitrary code by convincing a user to open a specially crafted Excel file. The NVD entry lists a high impact (C/H/I/A) with CVSS v3.1 score 7.8 (LOCAL attack vecto...

CVE-2020-4302

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID:...

CVE-2020-4302: Improper Neutralization of Formula Elements in a CSV File

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID:...

PT-2020-17985

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.0 through 11.1 Description The issue allows a remote attacker to execute arbitrary code on the system due to a CSV injection. This can be exploited by persuading a victim to open a specially-crafted Excel file,...

CVE-2020-4689: Improper Neutralization of Formula Elements in a CSV File

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

PT-2020-18204

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.2 Description The issue allows a remote privileged attacker to execute arbitrary commands on the system due to improper validation of csv file contents. This is caused by a CVS Injection flaw. Recommendations F...

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities

Summary Security vulnerabilities have been addressed in IBM Cognos Analytics. Vulnerability Details CVEID: CVE-2020-1747 DESCRIPTION: PyYAML could allow a remote attacker to execute arbitrary code on the system, caused by an error when processing untrusted YAML files through the fullload method o...

CVE-2020-4689

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

CVE-2020-14026

CSV Injection aka Excel Macro Injection or Formula Injection exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export...

Design/Logic Flaw

CSV Injection aka Excel Macro Injection or Formula Injection exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export...

CVE-2020-14026: Improper Neutralization of Formula Elements in a CSV File

CSV Injection aka Excel Macro Injection or Formula Injection exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export...

PT-2020-13850

Name of the Vulnerable Software and Affected Versions Ozeki NG SMS Gateway versions prior to 4.17.7 Description A CSV Injection issue exists in the Export Of Contacts feature due to mishandled values in CSV exports. Recommendations For Ozeki NG SMS Gateway versions prior to 4.17.7, update to...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

Awesome Web Security 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage of...

i-doit CMDB <= 1.14.2 Multiple Vulnerabilities

i-doit CMDB is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Design/Logic Flaw

A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...

CVE-2020-13826

The CVE-2020-13826 entry concerns i-doit 1.14.2, where a CSV export mishandles the Title parameter, enabling CSV/Excel macro injection that could execute arbitrary commands. This is a vulnerability in the CSV export functionality, caused by unsafely embedded data in export output. Affected compon...