6790 matches found
CVE-2016-1000222
Elastic Logstash before version 2.1.2 is vulnerable to input crafted to place malicious formulas in CSV output, as described by CVE-2016-1000222. The issue arises in the CSV writer when processing engineered input. Affected product: Elastic Logstash (CSV output). Root cause: CSV generation accept...
CVE-2016-1000222
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...
CVE-2016-1000222
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...
CVE-2016-1000222: Improper Neutralization of Argument Delimiters in a Command
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...
PT-2017-7673
Name of the Vulnerable Software and Affected Versions Logstash versions prior to 2.1.2 Description The issue allows an attack on the CSV output via engineered input, which can create malicious formulas in the CSV data. Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later ...
AtMail Cross-Site Request Forgery Vulnerability
AtMail is an open source WebMail client from the Australian company Atmail , which provides a Webmail interface , address book management , calendars and other features , and supports IMAP, video mail and so on. A cross-site request forgery vulnerability exists in AtMail versions prior to 7.8.0.2...
CVE-2017-9517
atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV...
CVE-2017-9517
atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV...
CVE-2017-9517: Cross-Site Request Forgery (CSRF)
atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV...
PT-2017-18984
Name of the Vulnerable Software and Affected Versions atmail versions prior to 7.8.0.2 Description The issue allows an attacker to perform actions such as uploading and importing users via CSV due to CSRF. Recommendations For versions prior to 7.8.0.2, update to version 7.8.0.2 or later to resolv...
PT-2017-15230
Name of the Vulnerable Software and Affected Versions Captcha versions prior to 4.3.0 Car Rental versions prior to 1.0.5 Contact Form Multi versions prior to 1.2.1 Contact Form versions prior to 4.0.6 Contact Form to DB versions prior to 1.5.7 Custom Admin Page versions prior to 0.1.2 Custom Fiel...
PlaySMS 1.4 - import.php Remote Code Execution
PlaySMS 1.4 - import.php Remote Code Execution Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22...
PlaySMS 1.4 - 'import.php' Remote Code Execution
Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website: http://touhidshaikh.com/ Category: webapps ...
Weblate: CSV Injection with the CVS export feature - Glossary
Hi, The "Download as a CSV" feature of Weblate does not properly "escape" fields. Here is more information about this issue: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/ Here is one method to reproduce this issue: 1 I can add new information in Glossary with a name...
Weblate: CSV export filter bypass leads to formula injection.
Dear Weblate bug bounty team, Summary --- The new filter can be bypassed using: %0A-3+3+cmd|' /C calc'!D2. python text = "%0A-3+3+cmd|' /C calc'!D2" def csvfilterbypass: if text and text0 in '=', '+', '-', '@': return "'" + text return text How can this be fixed? --- You need to escape and detect...
Weblate: CSV Injection with the CSV export feature
Step to reproduce : 1.go to https://hosted.weblate.org/dictionaries/aptoide-uploader/bn/add 2.add "=1+1" to Source and Translation filed F178723 3.now do CSV export 4.you can see all the cell is displayed as "2" which means the code is executed. Best Regad's, Jay Patel...
WS-2017-3798
In weblate in versions weblate-2.5 to weblate-2.13.1 is vulnerable to CSV Injection with the CVS export feature in weblate/trans/exporters.py...
April 18, 2017âKB4015553 (Preview of Monthly Rollup)
None None...
RHEL 7 : libreoffice (RHSA-2017:0914)
An update for libreoffice is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
Moderate: Red Hat Security Advisory: libreoffice security and bug fix update
An update for libreoffice is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...