PT-2018-18856

Name of the Vulnerable Software and Affected Versions AcyMailing extension versions prior to 5.9.6 for Joomla! Description The issue exists in the export feature of the AcyMailing extension, where a value is mishandled in a CSV export, leading to CSV Injection, also known as Excel Macro Injection...

PT-2018-18855

Name of the Vulnerable Software and Affected Versions AcySMS extension versions prior to 3.5.1 for Joomla! Description The issue exists in the export feature of the AcySMS extension, where a value is mishandled in a CSV export, leading to CSV Injection, also known as Excel Macro Injection or...

CVE-2018-9107: Improper Neutralization of Formula Elements in a CSV File

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export...

Pegasystem PEGA Platform Access Control Vulnerability

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A security vulnerability exists in th...

Weblate: CSV Injection with the CVS export feature - Glossary

Hi, The "Download as a CSV" feature of Weblate does not properly "escape" fields. Here is more information about this issue: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/ Here is one method to reproduce this issue: 1 I can add new information in Glossary with a name...

Gratipay: CSV injection in gratipay.com via payment history export feature.

I discovered this issues thanks to Matt who pointed out that the participant's name is directly placed into a CSV file: https://github.com/gratipay/gratipay.com/issues/4399issuecomment-292250609 Summary --- Gratipay allows users to export payment history as a .csv file. By injecting a payload int...

UBUNTU-CVE-2016-6611

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

HackerOne: Partial disclosure of report activity through new "Export as .zip" feature

Hello Team, I noticed a new feature has been launched, which allows to export report. Great feature. But unfortunately it discloses comments of partially disclosed reports which supposed to be hidden.. POC: Go to this partially disclosed report https://hackerone.com/reports/██████████ Click Expor...

UDAdmin.exe tool has been enhanced for better reporting and exporting of User Device License usage

Question: How to check license usage in Xendesktop/Xenapp with the enhanced UDAdmin.exe tool for reporting and monitoring? Answer: With License Server 11.14.0.1 Build 23101, some enhancements have been made to the UDAdmin command for better reporting of User Device License usage. The enhancements...

MGASA-2016-0291 Updated phpmyadmin packages fix security vulnerability

In phpMyAdmin before 4.4.15.8, the decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Also, the same initialization vector IV is used to hash the username and...

CVE-2013-3240

Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type...

CVE-2014-2375 Ecava IntegraXor SCADA Server External Control of File Name or Path

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service disk consumption, via the CSV export feature...

CVE-2014-2375: External Control of File Name or Path

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service disk consumption, via the CSV export feature...

CVE-2013-3240

Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type...

Directory traversal

Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type...

CVE-2013-3240

Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type...

CVE-2013-3240: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type...

PT-2013-4246

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.0.0-rc3 Description The issue concerns a directory traversal vulnerability in the Export feature. This allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a...

[SECURITY] Fedora 16 Update: python-mwlib-0.13.5-1.fc16

mwlib provides a library for parsing MediaWiki articles and converting them to different output formats. mwlib is used by Wikipedia's "Print/export" featu re in order to generate PDF documents from Wikipedia articles...

CVE-2009-0501

CVE-2009-0501 affects Moodle’s Calendar Export feature in Moodle 1.8.x before 1.8.8 and 1.9.x before 1.9.4. The root cause is a Calendar Export flaw that allows an attacker to obtain usernames (sensitive information) and perform brute-force attacks on user accounts. Exploitation vectors are not d...