CVE-2019-19676

A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering formula code in the following columns: Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung, an attacker can create a user with a name that contains malicious code. Other...

openSUSE Security Update : webkit2gtk3 (openSUSE-2020-278)

This update for webkit2gtk3 to version 2.26.4 fixes the following issues : Security issues fixed : - CVE-2019-8835: Fixed multiple memory corruption issues bsc1161719. - CVE-2019-8844: Fixed multiple memory corruption issues bsc1161719. - CVE-2019-8846: Fixed a use-after-free issue bsc1161719. -...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2020:0278-1 Rating: important References: 1159329 1161719 1163809 Cross-References: CVE-2019-8835 CVE-2019-8844 CVE-2019-8846 CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867 CVE-2020-3868 Affected...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:0468-1)

This update for webkit2gtk3 to version 2.26.4 fixes the following issues : Security issues fixed : CVE-2019-8835: Fixed multiple memory corruption issues bsc1161719. CVE-2019-8844: Fixed multiple memory corruption issues bsc1161719. CVE-2019-8846: Fixed a use-after-free issue bsc1161719...

Fedora 30 : webkit2gtk3 (2020-f11a905fc2)

Fix issues while trying to play a video on NextCloud. - Make sure the GL video sink uses a valid WebKit shared GL context. - Fix vertical alignment of text containing arabic diacritics. - Fix build with icu 65.1. - Fix page loading errors with websites using HSTS. - Fix web process crash when...

Arbitrary Code Injection

hot-formula-parser is vulnerable to arbitrary code injection. The vulnerability exists due to the lack of sanitization of the value of yytext, which is used in the exec command...

hot-formula-parser package for Node.js command injection vulnerability

hot-formula-parser package for Node.js is an Excel math formula parser for Node.js. A command injection vulnerability exists in grammar-parser.jison in the hot-formula-parser package for Node.js versions prior to 3.0.1. An attacker can use this vulnerability to execute arbitrary commands on the...

CVE-2020-6836

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may...

CVE-2020-6836

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may...

CVE-2020-6836

The CVE-2020-6836 entry refers to an arbitrary code injection in the hot-formula-parser package for Node.js, caused by grammar-parser.jison when parsing user-supplied input. Versions prior to 3.0.1 concatenate input into an eval call, enabling an attacker-controlled formula to execute arbitrary c...

PT-2020-19254

Name of the Vulnerable Software and Affected Versions hot-formula-parser versions prior to 3.0.1 Description The issue allows for arbitrary code injection due to the failure to sanitize values passed to the parse function, which are then concatenated in an eval call. If a formula value is taken...

CVE-2020-6836: Improper Control of Generation of Code

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may...

Command Injection

Overview Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it in an eval call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary...

CVE-2019-6187: Improper Neutralization of Formula Elements in a CSV File

A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller XCC that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV...

CSV Injection on node label

Summary CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. An authenticated malicious user can insert a crafted formula in the node label that can be later executed on another system after another user has downloaded and opened the node li...

PT-2019-15242 · Microsoft +1 · Office Excel +1

Name of the Vulnerable Software and Affected Versions: codepress-admin-columns plugin version 3.4.6 Description: A CSV injection in the codepress-admin-columns plugin for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as their first or last...

Code injection

The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code...

CVE-2015-8980

The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code...

CVE-2015-8980

CVE-2015-8980 affects php-gettext up to version 1.0.11, where the plural form in ngettext calls can be exploited to execute arbitrary code. The root cause is mishandling of input in Gettext, leading to remote code execution. Affected advisories reference Ubuntu USN-4779-1, Mageia MGASA-2017-0038,...

CVE-2019-11275

Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a na...