CVE-2018-10099

Google Monorail before 2018-04-04 has a Cross-Site Search XS-Search vulnerability because CSV downloads are affected by CSRF, and calculations of download times for requests with duplicated columns can be used to obtain sensitive information about the content of bug reports...

IBM API Connect CSV Injection Vulnerability

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. A CSV injection vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.8.4 and versions...

phpMyFAQ CSV Injection Vulnerability

phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A CSV injection vulnerability exists in the admin...

WordPress Ninja Forms CSV Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Ninja Forms is one of the form creation plugin . A CSV injection vulnerability exists in WordPress Ninja Forms. An...

CVE-2018-16275

OPSWAT MetaDefender before v4.11.2 allows CSV injection...

CVE-2018-12571

uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the origurl parameter, possibly causing a traffic amplification and/or SSRF outcome...

CVE-2018-11526

The plugin "WordPress Comments Import & Export" for WordPress v2.0.4 and before is vulnerable to CSV Injection...

PT-2018-10637 · Woocommerce · Advanced Order Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: Advanced Order Export For WooCommerce versions 1.5.4 and earlier Description: The issue concerns a CSV Injection vulnerability. Recommendations: For versions 1.5.4 and earlier, update to a version later than 1.5.4 to resolve the issue...

CVE-2017-3936

OS Command Injection vulnerability in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output...

IBM Robotic Process Automation with Automation Anywhere Arbitrary Command Execution Vulnerability

IBM Robotic Process Automation with Automation Anywhere is a process automation solution developed by IBM USA and Automation Anywhere. A security vulnerability exists in IBM Robotic Process Automation with Automation Anywhere version 10.0, which stems from the program's failure to properly encode...

UBUNTU-CVE-2018-11652

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report...

Shopy Point of Sale Command Injection Vulnerability

Shopy Point of Sale is a PHP-based retail store sales system. A CSV injection vulnerability exists in Shopy Point of Sale version 1.0. An attacker can exploit this vulnerability to inject commands and execute code...

Centers for Disease Control and Prevention MicrobeTRACE Remote Code Execution Vulnerability

Centers for Disease Control and Prevention MicrobeTRACE is a suite of sequence analysis and data visualization tools from the Centers for Disease Control and Prevention CDC. A security vulnerability exists in Centers for Disease Control and Prevention MicrobeTRACE version 0.1.12. The vulnerabilit...

HRSALE The Ultimate HRM CSV Injection Vulnerability

HRSALE The Ultimate HRM is a PHP-based human resource management system. A CSV injection vulnerability exists in HRSALE The Ultimate HRM version 1.0.2. An attacker can exploit this vulnerability to inject commands and execute code...

CVE-2018-10258

A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

CVE-2018-8974

Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial 'Source...

CVE-2016-9094

Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file...

Convert Forms CSV Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A CSV injection vulnerability exists in Joomla! Convert Forms 2.0.3 and earlier versions. When a user with elevated privileges exports form data in CSV format, an attacker can explo...

CVE-2018-10063

The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when exporting a Leads file...

Wordpress Contact Form 7 to Database Extension Plugin CSV Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A CSV injection vulnerability exists in the Wordpress Contact Form 7 to Database Extension plugin, which can be exploited by ...