CVE-2022-28864

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the...

CVE-2022-28864

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the...

PT-2023-12954 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct version 22 Description: An issue was discovered in the Administration of Measurements website section, where a malicious user can edit or add the templateName parameter to include malicious code. This code is then downloaded as a...

CVE-2023-37962

A cross-site request forgery CSRF vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

IBM Cloud Pak for Data 安全漏洞

IBM Cloud Pak for Data is a cloud-native solution from International Business Machines IBM that allows customers to use data and analyze it quickly and efficiently. A security vulnerability exists in IBM Cloud Pak for Data version 4.0 that stems from vulnerability to CSV injection attacks...

fossbilling 安全漏洞

fossbilling is a free open source solution for efficient billing and customer management. A security vulnerability exists in fossbilling versions prior to 0.5.3, which stems from improper neutralization of formula elements in CSV files...

Ericsson Network Manager 安全漏洞

Ericsson Network Manager is a network manager from Ericsson, Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. A security vulnerability exists in Ericsson Network Manager versions prior to 22.1, which stems from improperly neutralized formula...

CVE-2023-3302

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9...

Admidio 安全漏洞

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A security vulnerability exists in Admidio versions prior to 4.2.9 that stems from improper neutralization of formula elements in C...

Sage Group Sage X3 安全漏洞

Sage Group Sage X3 is a software application from Sage Group UK. An enterprise resource planning product developed for mature organizations. A security vulnerability exists in Sage X3 version 12.14.0.50-0, which stems from vulnerability to CSV injection attacks...

miniCal 安全漏洞

miniCal is miniCal open source an open source PMS. miniCal 1.0.0 and earlier versions exist CSV injection vulnerability , the vulnerability stems from improperly neutralized formula elements in CSV files , an attacker can exploit the vulnerability to remotely execute code...

Pimcore 安全漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. Pimcore suffers from a CSV injection...

RosarioSIS 安全漏洞

RosarioSIS is a free and open source student information system. It is used to manage students, create reports and make the right decisions. A security vulnerability exists in RosarioSIS version 10.8.4 that stems from a CSV injection in Periods Module...

PT-2023-22475 · Unknown · Rosariosis

Name of the Vulnerable Software and Affected Versions: RosarioSIS version 10.8.4 Description: The issue concerns a CSV injection vulnerability via the Periods Module. Recommendations: For RosarioSIS version 10.8.4, consider disabling access to the Periods Module until a patch is available. At the...

PT-2023-22702 · Ebankit · Ebankit

Name of the Vulnerable Software and Affected Versions: ebankIT versions prior to 7 Description: An issue allows a Denial-of-Service attack through the EStatementsIds GET parameter located on the "/Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx" endpoint. This parameter accepts...

ChurchCRM 安全漏洞

ChurchCRM is an open source CRM system for churches. ChurchCRM v4.5.3 suffers from a CSV injection vulnerability that stems from improperly neutralizing a formula element via the last name and first name input fields when creating a new account, which can be exploited by an attacker to execute...

PT-2023-20033 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: The issue allows attackers to execute arbitrary code via a crafted Excel file, exploiting a CSV injection vulnerability. This vulnerability is present in the Last Name and First Name input fields when...

The vulnerability of the FortiAnalyzer security event monitoring and analysis tool lies in the lack of a mechanism to neutralize elements in CSV files, allowing attackers to execute arbitrary code.

The vulnerability of the FortiAnalyzer event tracking and analysis tool lies in the absence of a mechanism to neutralize certain elements within the CSV file. Exploiting this vulnerability could allow an attacker to execute arbitrary code by inserting Excel formulas as names of macros within the...

Fortinet FortiAnalyzer 安全漏洞

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

SUSE CVE-2017-17843

An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and ...