Input validation

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...

CVE-2020-25445

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...

CVE-2020-25445: Improper Neutralization of Formula Elements in a CSV File

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...

PT-2021-11142

Name of the Vulnerable Software and Affected Versions: Ultimate Booking System Booking Core version 1.7.0 Description: The issue concerns the "Subscribe" feature, which is vulnerable to CSV formula injection. This occurs because input containing Excel formulas is not sanitized by the application...

CVE-2021-1474 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities

Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details secti...

Cisco Umbrella CSV Formula Injection Vulnerability

Cisco Umbrella is a cloud security platform that provides a first line of defense against Internet threats. A CSV formula injection vulnerability exists in Cisco Umbrella's "Administrator Audit Log Export" feature. The vulnerability stems from improper neutralization of formula elements in CSV...

CVE-2019-11275: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a na...

DokuWiki 2018-04-22a Greebo Arbitrary Code Execution Vulnerability

DokuWiki version 2018-04-22a Greebo suffers from a CSV formula injection vulnerability that allows for arbitrary code execution. ======================================================================= title: CSV Formula Injection product: DokuWiki vulnerable version: 2018-04-22a "Greebo" and olde...

DokuWiki 2018-04-22a Greebo Arbitrary Code Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: CSV Formula Injection product: DokuWiki vulnerable version: 2018-04-22a "Greebo" and older versions fixed version: None CVE number: CVE-2018-15474 impact: Medium homepage...