8446 matches found
KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection
KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS...
KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection
Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform: Node.js CVE: CVE-2017-15879 Vendor...
CVE-2017-15879
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
CVE-2017-15879
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
X (Formerly Twitter): OS Command Execution on User's PC via CSV Injection
Summary: Twitter is vulnerable to CSV Injection. If an attacker can successfully exploit this, then they will compromise the PC of the user. The injection point is via a tweet on the main twitter.com site while the retrieval point is via the “Export Data” option on the analytics site. Description...
CVE-2017-15879
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
CVE-2017-15879
CVE-2017-15879 affects KeystoneJS before 4.0.0-beta.7. The CSV injection vulnerability arises in the CSV export path via values mishandled in admin/server/api/download.js and lib/list/getCSVData.js, enabling Excel macro/formula injection. Documentation indicates the issue exists prior to version ...
Memory Corruption Vulnerability in WPS Forms (CNVD-2017-34134)
WPS Office is an office software suite developed independently by Kingsoft Corporation. A memory corruption vulnerability exists in the kso module of formset.exe in WPS when parsing a specific xls file, which can be exploited by an attacker to cause a denial of service or code execution...
Microsoft Excel - OLE Arbitrary Code Execution Exploit
Exploit for windows platform in category dos / poc Title: MS Office Excel all versions Arbitrary Code Execution Vulnerability Date: September 30th, 2017. Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: https://products.office.com/ Version: 2007,2010,2013,2016...
Memory Corruption Vulnerability in WPS Forms (CNVD-2017-34137)
WPS Office is an office software suite developed independently by Kingsoft Corporation. A memory corruption vulnerability exists in the kso module of formset.exe in WPS when parsing a specific xls file, which can be exploited by an attacker to cause a denial of service or code execution...
Memory Corruption Vulnerability in WPS Forms (CNVD-2017-34135)
WPS Office is an office software suite developed independently by Kingsoft Corporation. A memory corruption vulnerability exists in the etmain module of the form et.exe in WPS when parsing a specific xls file, which can be exploited by an attacker to cause a denial of service or code execution...
October 10, 2017—KB4041690 (Monthly Rollup)
None None...
October 10, 2017—KB4041679 (Security-only update)
None None...
Ian Dunn: Formula injection via CSV exports in WordCamp Talks plugin
The WordCamp Talks plugin does not attempt to sanitize CSV exports, which can lead to spreadsheet formula injection via malicious inputs. POC ======== Submit a new talk with the title of =1+1. Visit the All Talks page /wp-admin/edit.php?posttype=talks Click the CSV Export link Open the downloaded...
Microsoft Office Excel xls File Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Office Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...
Description of the security update for the Microsoft Jet database engine remote code execution vulnerability: October 10, 2017
None None...
"Unexpected error from external database driver" error when you create or open Microsoft Excel .xls files
None None...
Microsoft JET Database Engine Remote Code Execution Vulnerability
A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or...
Microsoft Windows XLS File Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Microsoft...
Microsoft Windows XLS File Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Microsoft...