Nextcloud: Formula Injection vulnerability in CSV export feature

Dear Nextcloud Team – I have identified a formula injection vulnerability 12 in the CSV export feature of the Forms App. I am aware that the Forms app is not part of this bug bounty program but was advised to disclose it via hackerone anyway. Description. When a n Excel-/Calc- formula is sent as...

July 14, 2020—KB4565541 (Monthly Rollup)

None None...

Wise Chat < 2.8.4 - CSV Injection

It could allow an unauthenticated or low privileges user to inject a command in chat messages that will be included in the exported CSV file via message backup, leading to possible code execution...

WordPress Wise Chat plugin <= 2.8.3 - CSV Injection vulnerability

CSV Injection vulnerability found by Vishnupriya Ilango Fortinet's FortiGuard Labs in WordPress Wise Chat plugin versions = 2.8.3. Solution Update the WordPress Wise Chat plugin to the latest available version at least 2.8.4...

CVE-2020-7049

Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...

CVE-2020-7049

Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...

CVE-2020-7049

Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...

Input validation

Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...

CVE-2020-7049

Summary: CVE-2020-7049 affects Nozomi Networks OS prior to version 19.0.4 and enables CSV injection via the path /#/network?tab=network_node_list.html. The provided documents name this as a CSV injection vulnerability in Nozomi Networks OS, with the affected state clearly tied to versions before ...

CVE-2020-7049

Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...

CVE-2020-13247

BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...

Design/Logic Flaw

BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...

CVE-2020-13247

BooleBox Secure File Sharing Utility (before 4.2.3.0) is affected by two CVEs in the dataset: CVE-2020-13247 enables CSV injection via a crafted username exported from activity logs in Audit Area; CVE-2020-13248 enables stored XSS via a crafted avatar field in My Account JSON data to Account.aspx...

CVE-2020-13247

BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...

Cross-site Request Forgery (CSRF)

WooCommerce is vulnerable to cross-site request forgery CSRF. The attack exists because it does not check the .csv file imports in includes/admin/importers/class-wc-product-csv-importer-controller.php, allowing an attacker to provide malicious inputs and valid nonce to lead to the attack...

CVE-2019-20891

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...

CVE-2019-20891

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...

Cross site request forgery (csrf)

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...

CVE-2019-20891

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...

CVE-2019-20891

CVE-2019-20891 affects WooCommerce prior to version 3.6.5. The issue is a cross-site request forgery (CSRF) in the CSV product-import workflow that can lead to stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php. Impact is described as CSRF ...