748 matches found
CVE-2020-16214
CVE-2020-16214 affects Philips PIC iX (PICiX) — versions B.02, C.02, C.03 — where user data saved to CSV files can include elements that are not properly neutralized, potentially enabling command interpretation when opened in spreadsheet software.Connected documents confirm the root cause: improp...
CVE-2020-16214 Philips Patient Monitoring Devices Improper Neutralization of Formula Elements in a CSV File
In Patient Information Center iX PICiX Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadshee...
CVE-2020-16214: Improper Neutralization of Formula Elements in a CSV File
In Patient Information Center iX PICiX Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadshee...
Microsoft Windows JET Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the JET database...
Cross-Site Scripting (XSS)
silverstripe-australia/advancedreports is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via a malicious CSV file...
Cross-site Request Forgery (CSRF)
WooCommerce is vulnerable to cross-site request forgery CSRF. The attack exists because it does not check the .csv file imports in includes/admin/importers/class-wc-product-csv-importer-controller.php, allowing an attacker to provide malicious inputs and valid nonce to lead to the attack...
CVE-2020-5298: Improper Neutralization of Alternate XSS Syntax
In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the ImportExportController behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a...
PT-2020-18387
Name of the Vulnerable Software and Affected Versions OctoberCMS versions 1.0.319 through 1.0.465 Description A user with the ability to use the import functionality of the ImportExportController behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file, which...
Microsoft Windows JET Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the JET database...
SAP Enable Now Input Validation Error Vulnerability (CNVD-2020-09648)
SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is mainly used for online learning and training in SAP and non-SAP systems. SAP Enable Now Input Validation Error Vulnerability. An attacker could use this vulnerability to enter commands in...
PT-2019-17117
Name of the Vulnerable Software and Affected Versions IBM Cloud Pak System version 2.3 Description The issue is related to improper validation of csv file contents, allowing a remote attacker to execute arbitrary commands on the system. Recommendations For IBM Cloud Pak System version 2.3, update...
CVE-2019-6187: Improper Neutralization of Formula Elements in a CSV File
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller XCC that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV...
CVE-2019-17114
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...
Cross site scripting
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...
Input validation
A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file...
CVE-2019-16184
A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file...
PT-2019-14564
Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description A CSV injection issue allows survey participants to inject commands via their survey responses that will be included in the export CSV file. Recommendations For versions prior to 3.17.14, update...
WordPress Simple 301 Redirects Plugin < 1.25 Multiple Vulnerabilities
The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...
Security Bulletin: IBM Cognos Disclosure Management could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious document (CVE-2016-6077)
Summary A specific usage scenario of IBM Cognos Disclosure Management could allow an Excel Macro execution on the client machine. Vulnerability Details CVEID: CVE-2016-6077 DESCRIPTION: IBM Cognos Disclosure Management could allow a remote attacker to insert a specially crafted Macro inside an...