Ericsson ECM 注入漏洞

Ericsson Ecm is a cloud manager from Ericsson Sweden. A security vulnerability exists in Ericsson ECM versions prior to 18.0 that stems from the fact that in Ericsson ECM prior to 18.0, the security provider endpoint in the user profile management section is vulnerable to CSV injection...

Improper Input Validation

Overview html-to-csv is an utility that extracts tables from HTML documents and converts them to CSV format Affected versions of this package are vulnerable to Improper Input Validation. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be...

CVE-2021-27020

Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export...

UBUNTU-CVE-2021-27020

Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export...

Puppet 安全漏洞

Puppet is a client/server C/S architecture based configuration management tool from Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. Puppet Enterprise is the enterprise version o...

Pimcore 安全漏洞

Pimcore is a set of open source Web content management platform for creating and managing Web applications from Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications.Pimcore versions prior to 10.1.1 have a...

IBM Maximo Asset Management 注入漏洞

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. IBM Maximo Asse...

CVE-2021-22771

A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older that would allow arbitrary command execution...

CVE-2021-22722

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Stored Cross-site Scripting' vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all...

Booking Core 安全漏洞

Booking Core is an application. A Laravel-based booking system designed for travel websites, malls, travel agents, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites.Booking Core has a security vulnerability that stems from the subscription functionality in Ultimate Booking...

The vulnerability of the osTicket customer support system, related to the lack of mechanisms to neutralize elements in the CSV file, allows a violator to execute arbitrary code.

The vulnerability of the osTicket customer support system lies in the lack of a mechanism to eliminate certain elements in the CSV file specifically, the fields “Name” and “Internal Notes” in the “Users” tab. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Akaunting 安全漏洞

Akaunting is a free, open source online accounting software designed for small businesses and freelancers. A CSV injection vulnerability exists in the project name field of the export function in Akaunting. An attacker can exploit this vulnerability to inject arbitrary code into the name paramete...

Authentication flaw

There is an Assertion in 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' in parserparseobjectinitializer in JerryScript 2.2.0...

June 1, 2021, update for Office 2016 (KB5001948)

None None...

The vulnerability of the virtual learning environment Moodle, related to the disclosure of information that allows a intruder to gain unauthorized access to protected information in CSV format.

The vulnerability in the virtual learning environment Moodle is related to the disclosure of information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information in CSV format...

PT-2021-3112 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.8 to 3.8.8 Moodle versions 3.9 to 3.9.6 Moodle versions 3.10 to 3.10.3 Description: The issue is related to information disclosure. Exploitation of this issue could allow a remote attacker to gain unauthorized access to...

CVE-2021-24254

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack...

DEBIAN-CVE-2021-32055

Mutt 1.11.0 through 2.0.x before 2.0.7 and NeoMutt 2019-10-25 through 2021-05-04 has a $imapqresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imapqresync setting for QRESYNC is not enabled by default...

AZL-7292 CVE-2021-32055 affecting package mutt for versions less than 2.0.5-4

Mutt 1.11.0 through 2.0.x before 2.0.7 and NeoMutt 2019-10-25 through 2021-05-04 has a $imapqresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imapqresync setting for QRESYNC is not enabled by default...

CVE-2021-32055

Mutt 1.11.0 through 2.0.x before 2.0.7 and NeoMutt 2019-10-25 through 2021-05-04 has a $imapqresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imapqresync setting for QRESYNC is not enabled by default...