CVE-2019-13181

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

Serv-U FTP Server CSV Injection Vulnerability

Serv-U is an award-winning FTP server software developed by Rob Beckers, full name: Serv-U FTP Server. FTP server users can share files on the internet through it using the FTP protocol. Serv-U FTP Server suffers from a CSV injection vulnerability that can be exploited by an attacker with the...

CVE-2019-0403

SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection...

Unspecified Vulnerability in IBM Cloud Pak System Platform System Manager

IBM Cloud Pak System is a complete stack converged infrastructure from IBM USA. The product provides a virtualized cloud operating environment for applications. A CVS injection vulnerability exists in Platform System Manager in IBM Cloud Pak System versions 2.3 through 2.3.0.1, which stems from t...

CVE-2019-6187

A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller XCC that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV...

IBM UrbanCode Deploy File Download Vulnerability

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

CSV Injection on node label

Summary CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. An authenticated malicious user can insert a crafted formula in the node label that can be later executed on another system after another user has downloaded and opened the node li...

CVE-2019-11275

Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a na...

DRUPAL-CONTRIB-2019-067

This module allows you to attach tabular data to an entity. There is insufficient access checking for users with the ability to "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities. This vulnerability is mitigated by the fact that an...

Limesurvey CSV Injection Vulnerability

limesurvey is an open source online questionnaire program with multiple functions such as questionnaire design, modification, release, recovery and statistics. A CSV injection vulnerability exists in Limesurvey versions prior to 3.17.14. An attacker can exploit this vulnerability to inject comman...

WordPress Event Tickets Plugin CSV Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. photo-gallery is one of the photo gallery plugins used in it. A CSV injection vulnerability exists in the implementation of the WordPress Event Tickets plugin prior to version 4.10.7.2. The vulnerability stems from a lack of prope...

CVE-2019-16120

CSV injection in the event-tickets Event Tickets plugin before 4.10.7.2 for WordPress exists via the "All Post Ticketed Attendees" Export Attendees feature...

WordPress simple-301-redirects-addon-bulk-uploader plugin redirection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. simple-301-redirects-addon-bulk-uploader is used in one of the Simple 301 Redirects redirect plugin to provide extended...

PT-2019-18010 · Lenovo · Lenovo Xclarity Administrator

Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator versions prior to 2.5.0 Description: A stored CSV Injection issue was reported that could allow an administrative user to store malformed data in Jobs and Event Log data. This could result in crafted formulas bei...

CVE-2019-15326

The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal...

WordPress FV Flowplayer Video Player Plugin Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.FV Flowplayer Video Player is a video player plugin used in it. An information disclosure vulnerability exists in the...

PT-2019-10403 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: wp-ultimate-csv-importer plugin versions prior to 5.6.1 Description: The issue concerns a CSRF problem in the wp-ultimate-csv-importer plugin for WordPress. Recommendations: For versions prior to 5.6.1, update to version 5.6.1 or later to...

WordPress Import users from CSV with meta plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Import users from CSV with meta is used in one of the import users plugin. A cross-site request forgery vulnerability exists in the...

CVE-2019-13144

myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5...

Magento Code Execution Vulnerability (CNVD-2019-39393)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9 and version 2.3...