2404 matches found
CVE-2020-13826: Improper Neutralization of Formula Elements in a CSV File
A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...
PT-2020-13707
Name of the Vulnerable Software and Affected Versions i-doit version 1.14.2 Description A CSV injection issue allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export. Recommendations For i-doit version 1.14.2, consider restricting the use of the...
CVE-2020-10780
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affect...
CVE-2020-10780
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affect...
Input validation
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affect...
CVE-2020-10780
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affect...
CVE-2020-10780
CVE-2020-10780 affects Red Hat CloudForms 4.7 and 5, where a CSV Injection flaw in Orchestration Templates can be triggered when a crafted CSV is exported and opened in Excel. The underlying issue is loosely validated parameters allowing CSV formulae to execute after the file is opened, enabling ...
CVE-2020-10780: Improper Neutralization of Formula Elements in a CSV File
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affect...
CSV Injection
cfme is vulnerable to CSV injection. The orchestration templates allow attackers to inject arbitrary CSV content such as formulas and exfiltrate data or further exploit other vulnerabilities...
Critical: Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
RHEL 8 : CloudForms 5.0.7 update (Critical) (RHSA-2020:3358)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3358 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...
PT-2020-3565
Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions 4.7 through 5 Description The issue is related to a CSV Injection flaw. A crafted payload can remain dormant until a victim exports it as a CSV file and opens it with Excel. Once the file is opened, the formula...
October CMS Build 465 XSS / File Read / File Deletion / CSV Injection
October CMS = Build 465 Multiple Vulnerabilities Author - Sivanesh Ashok | @sivaneshashok | stazot.com Date : 2020-03-31 Vendor : https://octobercms.com/ Version : = Build 465 Tested on : Build 465 CVE : CVE-2020-5295, CVE-2020-5296, CVE-2020-5297, CVE-2020-5298, CVE-2020-5299, CVE-2020-11083 Las...
October CMS Build 465 XSS / File Read / File Deletion / CSV Injection Vulnerabilities
October CMS builds 465 and below suffer from arbitrary file read, arbitrary file deletion, file uploading to arbitrary locations, persistent and reflective cross site scripting, and CSV injection vulnerabilities. October CMS = Build 465 Multiple Vulnerabilities Author - Sivanesh Ashok |...
Khan Academy: CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client Files
Insufficient CSV escaping could result in our site generating an unsafe CSV file for an end user under certain conditions. See the reporter's summary for more. Two CSV Injection Issues Was Discovered On Khan's Teacher CSV Export Function, That Could Allow Client Site Remote Code Execution, And...
Security Bulletin: CVE-2014-3524 CSV Injection in reports
Summary Cells in csv reports need to sanitize for legacy CSV Injection concerns. Vulnerability Details Third Party Entry: PSIRT-ADV0017245 DESCRIPTION: Created from Advisory: ADV0017245 CVSS Base score: 8.1 CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products and Versions...
Wise Chat < 2.8.4 - CSV Injection
It could allow an unauthenticated or low privileges user to inject a command in chat messages that will be included in the exported CSV file via message backup, leading to possible code execution...
WordPress Wise Chat plugin <= 2.8.3 - CSV Injection vulnerability
CSV Injection vulnerability found by Vishnupriya Ilango Fortinet's FortiGuard Labs in WordPress Wise Chat plugin versions = 2.8.3. Solution Update the WordPress Wise Chat plugin to the latest available version at least 2.8.4...