REDCap 安全漏洞

REDCap is a data collection and management web application from REDCap Open Source. A security vulnerability exists in REDCap version 14.9.6, which stems from a lack of CSRF protection for the logout feature, which allows an attacker to send a CSV file to the victim to view uploaded data...

DEBIAN-CVE-2024-9102

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value CSV file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet...

UBUNTU-CVE-2024-9102

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value CSV file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet...

phpLDAPadmin 安全漏洞

phpLDAPadmin is a web-based LDAP client from the phpLDAPadmin Personal Developer, which is primarily used to manage LDAP servers. A security vulnerability exists in phpLDAPadmin versions 1.2.0 through 1.2.6.7. An attacker exploiting this vulnerability can cause CSV formula injection...

PT-2024-39431 · Unknown +1 · Phpldapadmin +1

Name of the Vulnerable Software and Affected Versions: phpLDAPadmin versions 1.2.0 through 1.2.6.7 Description: The issue allows users to export elements from the LDAP directory into a Comma-Separated Value CSV file, but it does not neutralize special elements that could be interpreted as a comma...

PT-2024-41095 · Ооо 'Mсофт' · Mflash

Уязвимость платформы защищённого обмена данными MFlash связана с отсутствием нейтрализации элементов для файлов CSV. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольные команды...

PT-2024-35775 · Taiga · Taiga

Name of the Vulnerable Software and Affected Versions: Taiga version 6.8.1 Description: A CSV injection issue allows attackers to execute arbitrary code via uploading a crafted CSV file. This is achieved by loading a specifically manipulated CSV file, enabling the execution of arbitrary code...

Combodo iTop 跨站脚本漏洞

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for the daily operation of IT environments. The program provides incident management, configuration management and problem management. A cross-site scripting vulnerability exists in Combodo iT...

CVE-2024-7962 Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgpt

An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches specific criteria using an absolute path. The file must not have a .json extension and, except f...

The vulnerability of the HikCentral Master Lite video surveillance and security management software lies in the absence of a mechanism to neutralize certain elements in CSV files, allowing attackers to execute arbitrary commands.

The vulnerability of the HikCentral Master Lite video surveillance and security management software lies in the absence of a mechanism to neutralize certain elements in CSV files. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

Hikvision HikCentral Master Lite 安全漏洞

Hikvision HikCentral Master Lite is an AI Cloud-based application management intelligence platform for the edge domain from Hikvision, China. A security vulnerability exists in Hikvision HikCentral Master Lite, which stems from a CSV injection vulnerability that could allow an attacker to build...

PT-2024-10999 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is caused by a CSV injection vulnerability, which could allow a remote authenticated attacker to execute arbitrary code on the system. This can be achieved by persuading a...

CVE-2024-27321

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python...

Autolabel 安全漏洞

Autolabel is a Python library open-sourced by refuel-ai. It is used to label, clean, and enrich textual datasets using any Large Language Model LLM. A security vulnerability exists in Autolabel 0.0.8 and earlier versions, which stems from the presence of an arbitrary code execution vulnerability,...

CVE-2024-2541

The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an administrator has imported subscribers via...

WordPress Popup Builder plugin <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File vulnerability

Sensitive Information Exposure via Imported Subscribers CSV File vulnerability discovered by Tim Coen in WordPress Plugin Popup Builder versions = 4.3.6...

WordPress plugin WordPress plugin 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

Automation Anywhere Automation 360 安全漏洞

Automation Anywhere Automation 360 is a cloud-native end-to-end intelligent automation platform from Automation Anywhere, Inc. A security vulnerability exists in Automation Anywhere Automation 360 version 21094, which stems from the inclusion of a CSV injection vulnerability that allows an attack...

The vulnerability in the virtual learning environment Moodle arises from the lack of measures taken to protect the structure of web pages. This allows attackers to carry out XSS attacks.

The vulnerability in the virtual learning environment Moodle exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks by sending a specially crafted CSV file...

CVE-2024-3232

A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232...