CVE-2017-10792

There is a NULL Pointer Dereference in the function llinsert of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack...

CVE-2017-10792

There is a NULL Pointer Dereference in the function llinsert of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack...

Grab: CSV Injection https://hub.grab.com

@Poison had pointed out that it was possible to perform CSV Injection on hub.grab.com which was tested on Microsoft Excel 2016. Injection occurred by adding the payload in customer name field in Grab mobile application. The payload used was =cmd|' /C calc'!A0. We fixed this issue by properly...

Input validation

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...

CVE-2016-1000222

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...

CVE-2016-1000222

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...

CVE-2016-1000222

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...

CVE-2016-1000222

Elastic Logstash before version 2.1.2 is vulnerable to input crafted to place malicious formulas in CSV output, as described by CVE-2016-1000222. The issue arises in the CSV writer when processing engineered input. Affected product: Elastic Logstash (CSV output). Root cause: CSV generation accept...

CVE-2016-1000222

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...

PT-2017-7673

Name of the Vulnerable Software and Affected Versions Logstash versions prior to 2.1.2 Description The issue allows an attack on the CSV output via engineered input, which can create malicious formulas in the CSV data. Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later ...

CVE-2016-1000222: Improper Neutralization of Argument Delimiters in a Command

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data...

AtMail Cross-Site Request Forgery Vulnerability

AtMail is an open source WebMail client from the Australian company Atmail , which provides a Webmail interface , address book management , calendars and other features , and supports IMAP, video mail and so on. A cross-site request forgery vulnerability exists in AtMail versions prior to 7.8.0.2...

CVE-2017-9517

atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV...

CVE-2017-9517

atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV...

PT-2017-18984

Name of the Vulnerable Software and Affected Versions atmail versions prior to 7.8.0.2 Description The issue allows an attacker to perform actions such as uploading and importing users via CSV due to CSRF. Recommendations For versions prior to 7.8.0.2, update to version 7.8.0.2 or later to resolv...

CVE-2017-9517: Cross-Site Request Forgery (CSRF)

atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV...

PT-2017-15230

Name of the Vulnerable Software and Affected Versions Captcha versions prior to 4.3.0 Car Rental versions prior to 1.0.5 Contact Form Multi versions prior to 1.2.1 Contact Form versions prior to 4.0.6 Contact Form to DB versions prior to 1.5.7 Custom Admin Page versions prior to 0.1.2 Custom Fiel...

PlaySMS 1.4 - import.php Remote Code Execution

PlaySMS 1.4 - import.php Remote Code Execution Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22...

PlaySMS 1.4 - 'import.php' Remote Code Execution

Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website: http://touhidshaikh.com/ Category: webapps ...

Weblate: CSV Injection with the CVS export feature - Glossary

Hi, The "Download as a CSV" feature of Weblate does not properly "escape" fields. Here is more information about this issue: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/ Here is one method to reproduce this issue: 1 I can add new information in Glossary with a name...