CVE-2024-3232

A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232...

PT-2024-5556

Name of the Vulnerable Software and Affected Versions FortiAIOps version 2.0.0 Description The issue is related to an improper neutralization of formula elements in a CSV file, which may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV...

Fortinet FortiAIOps Security Breach

Fortinet FortiAIOps is a Fortinet networking companion solution that combines artificial intelligence and machine learning AI/ML from Fortinet, Inc. A security vulnerability exists in Fortinet FortiAIOps version 2.0.0, which stems from the presence of an unsatisfactory neutralization of a formula...

Malicious code in Be.Vlaanԁerеn.Basisregisters.AsрNetCore.Mvс.Formatters.Csv (NuGet)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-5527

The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

PT-2024-14815 · WordPress · The Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin plugin for WordPress versions up to, and including, 6.4.3 Description: The issue allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

WordPress Business Directory plugin <= 6.4.3 - Authenticated CSV Injection vulnerability

Authenticated CSV Injection vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Business Directory versions = 6.4.3...

WordPress plugin WS Form LITE security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of the members/moremember.pl and admin/aqbudgets.pl components of the Koha library process automation software allows a hacker to execute arbitrary commands.

The vulnerability of the members/moremember.pl and admin/aqbudgets.pl components of the Koha library process automation software is related to the absence of a mechanism to neutralize these elements in the CSV file. Exploiting this vulnerability allows a remote attacker to execute arbitrary DDE...

PT-2024-40381 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: CMS affected versions not specified Description: The issue concerns the CSV export feature of the CMS, where the output can contain macros and scripts. If these are imported into software like Microsoft Excel without proper sanitization, they...

Ghost Foundation Ghost 安全漏洞

Ghost Foundation Ghost is an open source personal blogging system written in JavaScript by Ghost. A security vulnerability exists in Ghost Foundation Ghost versions prior to 5.82.0, which stems from a vulnerability that allows an attacker to perform a CSV injection attack during a CSV export...

CVE-2023-32171

Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this...

CVE-2024-28764

IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623...

IBM WebSphere Automation 安全漏洞

IBM WebSphere Automation is an operations platform from International Business Machines IBM. automates operational activities to proactively reduce security risks and accelerate threat remediation. A security vulnerability exists in IBM WebSphere Automation version 1.7.0, which stems from imprope...

PT-2024-4605 · Asus · Asus Rt-N12+ B1

Name of the Vulnerable Software and Affected Versions: ASUS RT-N12+ B1 version affected versions not specified Description: The issue is related to a lack of data sanitization on the administrative level, allowing for the exploitation of a CSV injection vulnerability. This vulnerability enables a...

WordPress Plugin Import Users from CSV 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Import Users from CSV A co...

PT-2024-24435 · WordPress · Relevanssi

Name of the Vulnerable Software and Affected Versions: Relevanssi – A Better Search plugin for WordPress versions up to, and including, 4.22.1 Description: The issue allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these...

WordPress Relevanssi Premium plugin <= 2.25.1 - Unauthenticated Second Order CSV Injection vulnerability

Unauthenticated Second Order CSV Injection vulnerability discovered by Thura Moe Myint mgthuramoemyint in WordPress Plugin Relevanssi Premium versions = 2.25.1...

Ericsson Network Manager 安全漏洞

Ericsson Network Manager is a network manager from Ericsson Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. A security vulnerability exists in Ericsson Network Manager ENM versions prior to 23.1, which originates from improperly neutralized...

PT-2024-20696 · Ericsson · Ericsson Network Manager

Name of the Vulnerable Software and Affected Versions: Ericsson Network Manager ENM versions prior to 23.1 Description: The issue is related to the export function of the application log, where improper neutralization of formula elements in a CSV file can lead to code execution or information...