WordPress simple-301-redirects-addon-bulk-uploader plugin redirection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. simple-301-redirects-addon-bulk-uploader is used in one of the Simple 301 Redirects redirect plugin to provide extended...

PT-2019-18010 · Lenovo · Lenovo Xclarity Administrator

Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator versions prior to 2.5.0 Description: A stored CSV Injection issue was reported that could allow an administrative user to store malformed data in Jobs and Event Log data. This could result in crafted formulas bei...

CVE-2019-15326

The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal...

WordPress FV Flowplayer Video Player Plugin Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.FV Flowplayer Video Player is a video player plugin used in it. An information disclosure vulnerability exists in the...

PT-2019-10403 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: wp-ultimate-csv-importer plugin versions prior to 5.6.1 Description: The issue concerns a CSRF problem in the wp-ultimate-csv-importer plugin for WordPress. Recommendations: For versions prior to 5.6.1, update to version 5.6.1 or later to...

WordPress Import users from CSV with meta plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Import users from CSV with meta is used in one of the import users plugin. A cross-site request forgery vulnerability exists in the...

CVE-2019-13144

myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5...

CVE-2019-13144

myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5...

Magento Code Execution Vulnerability (CNVD-2019-39393)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9 and version 2.3...

CVE-2019-12961

LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function...

CVE-2019-4364

IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680...

Injection Vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An injection vulnerability exists in Joomla! An attacker can exploit this vulnerability to conduct CSV injection attacks...

PT-2019-12932 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered in the CSV export of com actionslogs, which is vulnerable to CSV injection. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 or later to resolve the iss...

CVE-2019-12134

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...

CVE-2018-12244

SEP Mac client prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection also known as formula injection vulnerability, which is a type of issue whereby an application or website allows untrusted input into CSV files...

CVE-2018-15906

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

PT-2019-19927 · Unknown · Donation Plugin/Fundraising Platform

Name of the Vulnerable Software and Affected Versions: Donation Plugin and Fundraising Platform versions prior to 2.3.1 Description: The issue concerns a cross-site scripting XSS vulnerability in the csv export functionality of the wp-admin/edit.php page. Recommendations: For versions prior to...

DEBIAN-CVE-2018-20752

An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote...

PT-2018-18718 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.6-15266 Description: The issue is related to improper neutralization of escape in the Log Exporter component, allowing remote attackers to inject arbitrary content when exporting an archi...

CVE-2018-10099

Google Monorail before 2018-04-04 has a Cross-Site Search XS-Search vulnerability because CSV downloads are affected by CSRF, and calculations of download times for requests with duplicated columns can be used to obtain sensitive information about the content of bug reports...