Input validation

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel CSV injection due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while...

CVE-2021-38180

SAP Business One 10.0 is vulnerable to CSV injection during data export. The root cause is improper sanitation of exported data, enabling an attacker to inject formulas in CSV exports. If a victim opens the CSV in Excel with macros enabled and the security settings allow command execution, this c...

CVE-2021-38180

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel CSV injection due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while...

CVE-2021-33722

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system...

CVE-2021-33722

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system...

Siemens SINEC NMS 路径遍历漏洞

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks.A path traversal vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1 when exporting firmware containers. An attacker could exploit this vulnerability to create arbitrary files on...

VMSA-2021-0022:VMware vRealize Log Insight updates address CSV injection vulnerability

Advisory ID: VMSA-2021-0022 CVSSv3 Range: 6.5 Issue Date:2021-10-12 Updated On: 2021-10-12 Initial Advisory CVEs: CVE-2021-22035 Synopsis: VMware vRealize Log Insight updates address CSV injection vulnerability CVE-2021-22035 RSS Feed Download PDF Download Text File Share this page on social medi...

CVE-2021-41128

Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions all CSV Exports Statistics & BAG MED contain a CSV Injection Vulnerability. Users of the system are able to submit formula as exported fields which then get...

CVE-2021-41128

Hygeia CSV Exports (Statistics & BAG MED) are vulnerable to CSV injection due to lack of validation/sanitization of formula fields in affected versions. Malicious input in exported fields can be executed when ingested. The issue has been fixed in version 1.30.4; upgrading is advised. No workaroun...

Hygeia 注入漏洞

Hygeia is an application used to collect and process personal and case data related to infectious diseases. Hygeia suffers from an injection vulnerability that stems from the ability for a system user to submit formulas as export fields, which can then be executed when ingesting the exported file...

WP All Export < 1.3.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed 1. Create a new export via "New Export" page. 2. Go to "Manage Exports...

WP All Export < 1.3.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC 1. Create a new export via "New Export" page. 2. Go to "Manage...

WordPress Export any WordPress data to XML/CSV plugin <= 1.3.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Huy Nguyen in WordPress Export any WordPress data to XML/CSV plugin versions = 1.3.0. Solution Update the WordPress Export any WordPress data to XML/CSV plugin to the latest available version at least 1.3.1...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

UBUNTU-CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

Code injection

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

CVE-2021-22258 affects GitLab releases 8.9 and newer, where the project import/export feature could be exploited to obtain otherwise private email addresses. The provided connected documents confirm the vulnerable component/function (import/export), the underlying issue being exposure of private ...