CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02

An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...

CVE-2024-42901

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...

CVE-2024-42901: Improper Neutralization of Input During Web Page Generation

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...

CVE-2024-2541 Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File

The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an administrator has imported subscribers via...

CVE-2024-2541

CVE-2024-2541 concerns the Popup Builder plugin for WordPress. It enables Sensitive Information Exposure in all versions up to 4.3.3 via the Subscribers Import feature, allowing unauthenticated attackers to access subscriber data (e.g., first name, last name, email, and potentially other PII) aft...

CVE-2024-2541: Exposure of Sensitive Information to an Unauthorized Actor

The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an administrator has imported subscribers via...

ROS-20240828-02

A vulnerability in GLPI's asset and data center management software is related to the CSV file injection by creating a file with a spoofed header. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive data...

CVE-2024-41226: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...

CVE-2024-41806: Improper Access Control

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

How to Export Target Devices into a .CSV File

This article details how to export Target Devices from a Provisioning Services PVS database in a formatted Comma Separated Values CSV file. Requirements SQL Server Management Studio or bcp.exe, both of which are components of a full SQL Server or SQL Server Express install...

CVE-2024-27785

An improper neutralization of formula elements in a CSV File CWE-1236 vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports...

CVE-2024-27785

An improper neutralization of formula elements in a CSV File CWE-1236 vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports...

CVE-2024-27785

CVE-2024-27785 affects Fortinet FortiAIOps 2.0.0. The flaw is improper neutralization of formula elements in CSV files, allowing a remote authenticated attacker to execute arbitrary commands on a client’s workstation via poisoned CSV reports. Exploitation requires authentication; an attacker can ...

CVE-2024-27785: Improper Neutralization of Formula Elements in a CSV File

An improper neutralization of formula elements in a CSV File CWE-1236 vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports...

Logpoint 安全漏洞

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.4.0, which stems from the fact that the sourcename parameter can be changed to an absolute path, which will write a CSV file to the tmp directory...

The vulnerability in the `inc/csv.php` script of the WordPress Automatic Plugin, a content management system for WordPress websites, allows attackers to execute arbitrary SQL code.

The vulnerability in the inc/csv.php script of the WordPress Automatic Plugin, a content management system for WordPress websites, relates to the failure to protect the SQL query structure during the processing of the $q variable, as a result of the authentication mechanism being bypassed...

Cross-site Scripting (XSS)

mindsdb is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper CSV file sanitization, which allows an attacker to uploud malicious JavaScript payloads embedded within CSV files, triggering XSS when viewed...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

PAN-OS Firewall Command Injection Vulnerability This reposito...

GHSA-93C5-RJ2P-W52X Cross-site Scripting (XSS) in mindsdb/mindsdb

When a user uploads a csv file that contains an javascript payload a Cross-site Scripting XSS is triggered when the file is viewed. This is true for both cloud version and OSS version...

Cross-site Scripting (XSS) in mindsdb/mindsdb

When a user uploads a csv file that contains an javascript payload a Cross-site Scripting XSS is triggered when the file is viewed. This is true for both cloud version and OSS version...