5472 matches found
Wise Chat < 2.8.4 - CSV Injection
It could allow an unauthenticated or low privileges user to inject a command in chat messages that will be included in the exported CSV file via message backup, leading to possible code execution...
WordPress Wise Chat plugin <= 2.8.3 - CSV Injection vulnerability
CSV Injection vulnerability found by Vishnupriya Ilango Fortinet's FortiGuard Labs in WordPress Wise Chat plugin versions = 2.8.3. Solution Update the WordPress Wise Chat plugin to the latest available version at least 2.8.4...
CVE-2020-7049
Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...
CVE-2020-7049
Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...
CVE-2020-7049
Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...
Input validation
Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...
CVE-2020-7049
Summary: CVE-2020-7049 affects Nozomi Networks OS prior to version 19.0.4 and enables CSV injection via the path /#/network?tab=network_node_list.html. The provided documents name this as a CSV injection vulnerability in Nozomi Networks OS, with the affected state clearly tied to versions before ...
CVE-2020-7049
Nozomi Networks OS before 19.0.4 allows //network?tab=networknodelist.html CSV Injection...
CVE-2020-13247
BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...
Design/Logic Flaw
BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...
CVE-2020-13247
BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...
CVE-2020-13247
BooleBox Secure File Sharing Utility (before 4.2.3.0) is affected by two CVEs in the dataset: CVE-2020-13247 enables CSV injection via a crafted username exported from activity logs in Audit Area; CVE-2020-13248 enables stored XSS via a crafted avatar field in My Account JSON data to Account.aspx...
Cross-site Request Forgery (CSRF)
WooCommerce is vulnerable to cross-site request forgery CSRF. The attack exists because it does not check the .csv file imports in includes/admin/importers/class-wc-product-csv-importer-controller.php, allowing an attacker to provide malicious inputs and valid nonce to lead to the attack...
CVE-2019-20891
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...
CVE-2019-20891
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...
Cross site request forgery (csrf)
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...
CVE-2019-20891
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...
CVE-2019-20891
CVE-2019-20891 affects WooCommerce prior to version 3.6.5. The issue is a cross-site request forgery (CSRF) in the CSV product-import workflow that can lead to stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php. Impact is described as CSRF ...