5374 matches found
CVE-2020-5298 Reflected XSS when importing CSV in OctoberCMS
In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the ImportExportController behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a...
WordPress Connections Business Directory plugin <= 9.6 - CSV Injection vulnerability
CSV Injection vulnerability discovered by Rudra Sarkar in WordPress Connections Business Directory plugin versions = 9.6. Solution Update the WordPress Connections Business Directory plugin to the latest available version at least 9.7...
Faraday v3.11 - Collaborative Penetration Test and Vulnerability Management Platform
This new release brings strong improvements to your security team’s daily performance , allowing them to operate quicker and smarter by increasing accessibility and stabilizing usual functionality. Major enhancements are focused on providing global visualization of findings , improvements on our...
CVE-2020-13146
Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...
Input validation
Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...
CVE-2020-13146
Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...
CVE-2020-13146
Open edX Ironwood 2.5 Studio is affected by a CSV injection vulnerability. The issue arises when an added cohort in Course > Instructor > Cohorts may contain a formula that is exported through Course > Data Downloads > Reports > Download profile info, allowing injection in exported...
CSV Injection
subrion is vulnerable to CSV injection. The injection is possible because it does not sanitize a phrase value within a language, which is related to phrases/add/ and languages/download/...
CVE-2020-12468
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/...
CVE-2020-12468
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/...
Input validation
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/...
CVE-2020-12468
Subrion CMS 4.2.1 is affected by CVE-2020-12468. The vulnerability allows CSV injection through a phrase value stored in a language, specifically related to phrases/add/ and languages/download/. The root cause is the lack of input sanitization for phrase values, enabling crafted content to be int...
CVE-2020-12468
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/...
WordPress Import Export WordPress Users Plugin < 1.3.9 Arbitrary User Creation Vulnerability
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
Shopify: A staff without export customers permissions can still export customers CSV file
Steps To Reproduce: 1. Login as staff without export customers permissions but with customers permissions. 2. Go to customers pages, you can still export customers CSV file. F805311 F805312 F805313 Impact A staff without export customers permissions can still export customers CSV file...
CVE-2020-12074
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV...
CVE-2020-12074
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV...
Code injection
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV...
CVE-2020-12074
The CVE concerns the WordPress plugin “users-customers-import-export-for-wp-woocommerce” (pre-1.3.9). The vulnerability allows subscribers to import new users, including administrative accounts, via a CSV import, enabling privilege escalation within WordPress. Root cause is improper validation/au...