Input validation

Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device...

CVE-2017-15313

Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device...

CVE-2017-15313

CVE-2017-15313 affects Huawei SmartCare V200R003C10, which has a CSV injection vulnerability. A remote authenticated attacker could inject malicious CSV expressions into the affected device. The connected documents confirm the vulnerability and its impact but do not provide exploit status beyond ...

PT-2017-13991

Name of the Vulnerable Software and Affected Versions Huawei SmartCare version V200R003C10 Description The issue allows a remote authenticated attacker to inject malicious CSV expressions into the affected device. Recommendations For version V200R003C10, at the moment, there is no information abo...

CVE-2017-15313: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device...

WordPress CSV Import-Export plugin <=1.1.0 - Multiple Cross-Site Scripting (XSS) vulnerabilities

Multiple Cross-Site Scripting XSS vulnerabilities found in WordPress CSV Import-Export plugin versions =1.1.0. Solution Dec 20, 2017 - we were unable to find a patched version of this plugin last updated three years ago. Uninstall or use it at your own risk...

WordPress CSV Import-Export 1.1 Cross Site Scripting Vulnerability

WordPress CSV Import-Export plugin version 1.1 suffers from a cross site scripting vulnerability. Product: CSV Import-Export Wordpress Plugin - https://wordpress.org/plugins/csv-import-export/ Vendor: eSparkBiz Tested version: 1.1 CVE ID: CVE-2017-17753 CVE description Multiple cross-site scripti...

Wordpress esb-csv-import-export plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . esb-csv-import-export plugin is used in one of the plug-ins for importing and exporting CSV files . A...

WordPress CSV Import-Export 1.1 Cross Site Scripting

Product: CSV Import-Export Wordpress Plugin - https://wordpress.org/plugins/csv-import-export/ Vendor: eSparkBiz Tested version: 1.1 CVE ID: CVE-2017-17753 CVE description Multiple cross-site scripting XSS vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote...

CVE-2017-17753

Multiple cross-site scripting XSS vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 cietype, 2 cieimport, 3 cieupdate, or 4 cieignore parameter to includes/admin/views/esb-cie-import-export-page.ph...

CVE-2017-17753

The CVE-2017-17753 entry concerns the WordPress plugin esb-csv-import-export (versions up to 1.1). The vulnerability is an XSS in includes/admin/views/esb-cie-import-export-page.php where the GET parameters cie_type, cie_import, cie_update, and cie_ignore are echoed back to the user without prope...

PT-2017-14987

Name of the Vulnerable Software and Affected Versions esb-csv-import-export plugin versions through 1.1 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via the cie type, cie import, cie update, or cie ignore parameter to the...

Csv Import-Export <= 1.1 - Authenticated Cross-Site Scripting (XSS)

The csv-import-export WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

CVE-2017-17753: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 cietype, 2 cieimport, 3 cieupdate, or 4 cieignore parameter to includes/admin/views/esb-cie-import-export-page.ph...

SS-2017-007: CSV Excel Macro Injection

More info at https://www.silverstripe.org/download/security-releases/ss-2017-007/...

Design/Logic Flaw

VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious conten...

CVE-2017-4931

VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious conten...

CVE-2017-4931

VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious conten...

CVE-2017-4931

CVE-2017-4931 affects VMware AirWatch Console 9.x before 9.2.0. An authenticated AWC user can add malicious data to an enrolled device’s log files, potentially causing a user to open a CSV containing malicious content. The issue is mitigated by upgrading to AirWatch Console 9.2.0 or later (update...

Keystone is vulnerable to CSV injection

CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...