824 matches found
DRUPAL-CONTRIB-2019-067
This module allows you to attach tabular data to an entity. There is insufficient access checking for users with the ability to "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities. This vulnerability is mitigated by the fact that an...
Limesurvey CSV Injection Vulnerability
limesurvey is an open source online questionnaire program with multiple functions such as questionnaire design, modification, release, recovery and statistics. A CSV injection vulnerability exists in Limesurvey versions prior to 3.17.14. An attacker can exploit this vulnerability to inject comman...
WordPress Event Tickets Plugin CSV Injection Vulnerability
WordPress is a blogging platform developed using the PHP language. photo-gallery is one of the photo gallery plugins used in it. A CSV injection vulnerability exists in the implementation of the WordPress Event Tickets plugin prior to version 4.10.7.2. The vulnerability stems from a lack of prope...
CVE-2019-16120
CSV injection in the event-tickets Event Tickets plugin before 4.10.7.2 for WordPress exists via the "All Post Ticketed Attendees" Export Attendees feature...
WordPress simple-301-redirects-addon-bulk-uploader plugin redirection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. simple-301-redirects-addon-bulk-uploader is used in one of the Simple 301 Redirects redirect plugin to provide extended...
PT-2019-18010 · Lenovo · Lenovo Xclarity Administrator
Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator versions prior to 2.5.0 Description: A stored CSV Injection issue was reported that could allow an administrative user to store malformed data in Jobs and Event Log data. This could result in crafted formulas bei...
CVE-2019-15326
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal...
WordPress FV Flowplayer Video Player Plugin Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.FV Flowplayer Video Player is a video player plugin used in it. An information disclosure vulnerability exists in the...
PT-2019-10403 · WordPress · Wp Ultimate Csv Importer
Name of the Vulnerable Software and Affected Versions: wp-ultimate-csv-importer plugin versions prior to 5.6.1 Description: The issue concerns a CSRF problem in the wp-ultimate-csv-importer plugin for WordPress. Recommendations: For versions prior to 5.6.1, update to version 5.6.1 or later to...
WordPress Import users from CSV with meta plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Import users from CSV with meta is used in one of the import users plugin. A cross-site request forgery vulnerability exists in the...
CVE-2019-13144
myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5...
CVE-2019-13144
myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5...
Magento Code Execution Vulnerability (CNVD-2019-39393)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9 and version 2.3...
CVE-2019-12961
LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function...
CVE-2019-4364
IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680...
Injection Vulnerability in Joomla!
Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An injection vulnerability exists in Joomla! An attacker can exploit this vulnerability to conduct CSV injection attacks...
PT-2019-12932 · Open Source Matters · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered in the CSV export of com actionslogs, which is vulnerable to CSV injection. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 or later to resolve the iss...
CVE-2019-12134
CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...
CVE-2018-12244
SEP Mac client prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection also known as formula injection vulnerability, which is a type of issue whereby an application or website allows untrusted input into CSV files...