CVE-2020-16214 Philips Patient Monitoring Devices Improper Neutralization of Formula Elements in a CSV File

In Patient Information Center iX PICiX Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadshee...

CVE-2020-16214

CVE-2020-16214 affects Philips PIC iX (PICiX) — versions B.02, C.02, C.03 — where user data saved to CSV files can include elements that are not properly neutralized, potentially enabling command interpretation when opened in spreadsheet software.Connected documents confirm the root cause: improp...

CVE-2020-16214: Improper Neutralization of Formula Elements in a CSV File

In Patient Information Center iX PICiX Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadshee...

Microsoft Windows JET Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the JET database...

Cross-Site Scripting (XSS)

silverstripe-australia/advancedreports is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via a malicious CSV file...

Cross-site Request Forgery (CSRF)

WooCommerce is vulnerable to cross-site request forgery CSRF. The attack exists because it does not check the .csv file imports in includes/admin/importers/class-wc-product-csv-importer-controller.php, allowing an attacker to provide malicious inputs and valid nonce to lead to the attack...

CVE-2020-5298: Improper Neutralization of Alternate XSS Syntax

In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the ImportExportController behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a...

Microsoft Windows JET Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the JET database...

SAP Enable Now Input Validation Error Vulnerability (CNVD-2020-09648)

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is mainly used for online learning and training in SAP and non-SAP systems. SAP Enable Now Input Validation Error Vulnerability. An attacker could use this vulnerability to enter commands in...

CVE-2019-6187: Improper Neutralization of Formula Elements in a CSV File

A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller XCC that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV...

CVE-2019-17114

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...

Cross site scripting

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...

Input validation

A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file...

WordPress Simple 301 Redirects Plugin < 1.25 Multiple Vulnerabilities

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

Security Bulletin: IBM Cognos Disclosure Management could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious document (CVE-2016-6077)

Summary A specific usage scenario of IBM Cognos Disclosure Management could allow an Excel Macro execution on the client machine. Vulnerability Details CVEID: CVE-2016-6077 DESCRIPTION: IBM Cognos Disclosure Management could allow a remote attacker to insert a specially crafted Macro inside an...

CVE-2019-15776

The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file...

CVE-2019-15776: URL Redirection to Untrusted Site

The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file...

TeamPass <= 2.1.27.36 Multiple XSS Vulnerabilities

TeamPass is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload...

CVE-2019-12950: Improper Neutralization of Input During Web Page Generation

An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload...