528 matches found
CVE-2020-13826
A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...
CVE-2020-13826: Improper Neutralization of Formula Elements in a CSV File
A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...
PT-2020-13707
Name of the Vulnerable Software and Affected Versions i-doit version 1.14.2 Description A CSV injection issue allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export. Recommendations For i-doit version 1.14.2, consider restricting the use of the...
PT-2020-3565
Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions 4.7 through 5 Description The issue is related to a CSV Injection flaw. A crafted payload can remain dormant until a victim exports it as a CSV file and opens it with Excel. Once the file is opened, the formula...
Nextcloud: Formula Injection vulnerability in CSV export feature
Dear Nextcloud Team – I have identified a formula injection vulnerability 12 in the CSV export feature of the Forms App. I am aware that the Forms app is not part of this bug bounty program but was advised to disclose it via hackerone anyway. Description. When a n Excel-/Calc- formula is sent as...
Design/Logic Flaw
In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the ImportExportController could potentially introduce a CSV injection into the data to cause the generated C...
CVE-2020-5299: Improper Neutralization of Special Elements used in a Command
In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the ImportExportController could potentially introduce a CSV injection into the data to cause the generated C...
Faraday v3.11 - Collaborative Penetration Test and Vulnerability Management Platform
This new release brings strong improvements to your security team’s daily performance , allowing them to operate quicker and smarter by increasing accessibility and stabilizing usual functionality. Major enhancements are focused on providing global visualization of findings , improvements on our...
Booked < 2.2.6 - Broken Authentication to Export Users Data in CSV
The plugin allows users to Book Appointment by providing their PII such as Email, Name, Phone Number and Personal Message. The vulnerability allows anyone to Dump all records of users and their appointment details in CSV as an unauthenticated user. The user also gets registered as a WP User after...
Booked < 2.2.6 - Broken Authentication to Export Users Data in CSV
The plugin allows users to Book Appointment by providing their PII such as Email, Name, Phone Number and Personal Message. The vulnerability allows anyone to Dump all records of users and their appointment details in CSV as an unauthenticated user. The user also gets registered as a WP User after...
CVE-2019-20184
KeePass 2.4.1 allows CSV injection in the title field of a CSV export...
PT-2020-10365
Name of the Vulnerable Software and Affected Versions KeePass version 2.4.1 Description The issue allows CSV injection in the title field of a CSV export. Recommendations For version 2.4.1, avoid using the title field in CSV exports until a fix is available. As a temporary workaround, consider...
CVE-2019-20184: Improper Neutralization of Formula Elements in a CSV File
KeePass 2.4.1 allows CSV injection in the title field of a CSV export...
Export Users to CSV < 1.4 - Unauthorised CSV Access
The plugin exports a CSV file containing sensitive user data. The generated files are stored in a public directory with a predictable filename based on a Unix timestamp. CSV files are discoverable either through enumeration or path traversal. Export Users to CSV does not provide visibility over...
CVE-2019-16184: Improper Neutralization of Formula Elements in a CSV File
A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file...
CVE-2018-14861
Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users...
CVE-2018-14861
Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users...
CVE-2018-14861
Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users...
CVE-2018-14861
An issue (CVE-2018-14861) affects Odoo Community 10.0/11.0 and Odoo Enterprise 10.0/11.0 where improper data access control allows authenticated users to export other users’ securely hashed passwords via CSV. Root cause: improper access controls on the CSV export feature. Impact: disclosure of pa...
