CVE-2019-20180

The TablePress plugin 1.9.2 for WordPress allows tablepressdata CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress...

PT-2020-10361 · Tablepress · Tablepress

Name of the Vulnerable Software and Affected Versions: TablePress plugin version 1.9.2 Description: The issue allows tablepressdata CSV injection by Editor users. This could potentially lead to malicious actions when the CSV file is opened by an application. Note that the vendor disputes this...

CVE-2019-20180

The CVE-2019-20180 entry concerns the WordPress TablePress plugin, version 1.9.2. The documented issue is a CSV injection in tablepress[data] that can be triggered by Editor users when exporting data, with the underlying claim that the vulnerability arises from how CSV is opened by the target app...

WooCommerce - Store Exporter < 2.4 - CSV Injection

A CSV Injection vulnerability was discovered in WooCommerce - Store Exporter v 2.3.1. It allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible command/code execution...

WordPress WooCommerce - Store Exporter plugin <= 2.3.1 - CSV Injection vulnerability

CSV Injection vulnerability found by Vishnupriya Ilango FortiGuard Labs in WordPress WooCommerce - Store Exporter plugin versions = 2.3.1. Solution Update the WordPress WooCommerce - Store Exporter plugin to the latest available version at least 2.4...

PT-2020-10365

Name of the Vulnerable Software and Affected Versions KeePass version 2.4.1 Description The issue allows CSV injection in the title field of a CSV export. Recommendations For version 2.4.1, avoid using the title field in CSV exports until a fix is available. As a temporary workaround, consider...

CVE-2019-20180: Improper Neutralization of Formula Elements in a CSV File

The TablePress plugin 1.9.2 for WordPress allows tablepressdata CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress...

CVE-2019-20184: Improper Neutralization of Formula Elements in a CSV File

KeePass 2.4.1 allows CSV injection in the title field of a CSV export...

WordPress Import Users From CSV with Meta plugin 1.15 - Unauthorised Authenticated Users Export vulnerability

Unauthorised Authenticated Users Export vulnerability found in WordPress Import Users From CSV with Meta plugin version 1.15. Solution Update WordPress Import Users From CSV with Meta plugin to the latest available version at least 1.15.0.1...

Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export

The exportuserscsv function, registered as an authenticated AJAX call and allowing to export users, was missing the authorisation/capability check. CSRF check was in place, reducing the severity of the issue. Only version 1.15 seems to be affected as the export functionality is a new feature...

PT-2019-6281 · WordPress · Wp Users Exporter

Name of the Vulnerable Software and Affected Versions: WP Users Exporter plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to CSV Injection via the 'Export Users' functionality, allowing authenticated attackers to embed untrusted input into profile...

Security Bulletin: CSV Injection (CVE-2019-4490)

Summary Maliciously crafted data in UCD could generate a malicious csv download file, when opened with certain unpactched 3rd party tools. Vulnerability Details CVEID: CVE-2019-4490 DESCRIPTION: CVSS Base score: 7.8 CVSS Temporal Score: See:...

CVE-2019-13181

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

CVE-2019-13181

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

Design/Logic Flaw

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

CVE-2019-13181

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

CVE-2019-13181

CVE-2019-13181 affects SolarWinds Serv-U FTP Server v15.1.7 where the web UI allows CSV injection: table entries can contain a string that is evaluated by Excel as a DDE macro when exporting user data (privileged users can inject macros via description fields). The vulnerability stems from input ...

CVE-2019-13181: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

Serv-U FTP Server 15.1.7 CSV Injection

Issue: CSV injection vulnerability CVE: CVE-2019-13181 Security researcher: Richard Tan @ The Missing Link Security Product name: Serv-U FTP Server Product version: Tested on 15.1.7 Fixed in: Serv-U 15.1.7 Hotfix 2 Overview The application allowed table entries to contain a string which could be...

PT-2019-13172

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U FTP Server version 15.1.7 Description A CSV injection issue exists in the web UI. Recommendations For SolarWinds Serv-U FTP Server version 15.1.7, at the moment, there is no information about a newer version that contains a f...