SearchBlox Security Breach

SearchBlox is an application from US-based SearchBlox, Inc. provides a powerful enterprise search architecture for on-premise or cloud deployments. A security vulnerability exists in SearchBlox versions prior to 9.2.1. An attacker can exploit the vulnerability to perform a CSV macro injection...

PT-2023-25495 · Gnome +1 · Gnome Time Tracker +1

Name of the Vulnerable Software and Affected Versions: GNOME time tracker version 3.0.2 Description: The issue allows local attackers to execute arbitrary code via a crafted .tsv file when creating a new record. This is a result of a CSV Injection vulnerability in the GNOME time tracker...

PT-2023-11771 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.2.0 Description: The issue allows remote attackers to execute arbitrary code via a crafted CSV file. This is a result of a CSV Injection vulnerability. Recommendations: For ChurchCRM version 4.2.0, update to a version that...

Tadiran Telecom Composit 安全漏洞

Tadiran Telecom Composit is a unified communications and collaboration platform from Tadiran Telecom, Israel. A security vulnerability exists in Tadiran Telecom Composit that stems from a CSV file with improper element neutralization...

CVE-2022-28864

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the...

CVE-2022-28864

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the...

CVE-2023-37962

A cross-site request forgery CSRF vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

IBM Cloud Pak for Data 安全漏洞

IBM Cloud Pak for Data is a cloud-native solution from International Business Machines IBM that allows customers to use data and analyze it quickly and efficiently. A security vulnerability exists in IBM Cloud Pak for Data version 4.0 that stems from vulnerability to CSV injection attacks...

fossbilling 安全漏洞

fossbilling is a free open source solution for efficient billing and customer management. A security vulnerability exists in fossbilling versions prior to 0.5.3, which stems from improper neutralization of formula elements in CSV files...

Ericsson Network Manager 安全漏洞

Ericsson Network Manager is a network manager from Ericsson, Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. A security vulnerability exists in Ericsson Network Manager versions prior to 22.1, which stems from improperly neutralized formula...

CVE-2023-3302

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9...

Sage Group Sage X3 安全漏洞

Sage Group Sage X3 is a software application from Sage Group UK. An enterprise resource planning product developed for mature organizations. A security vulnerability exists in Sage X3 version 12.14.0.50-0, which stems from vulnerability to CSV injection attacks...

miniCal 安全漏洞

miniCal is miniCal open source an open source PMS. miniCal 1.0.0 and earlier versions exist CSV injection vulnerability , the vulnerability stems from improperly neutralized formula elements in CSV files , an attacker can exploit the vulnerability to remotely execute code...

Pimcore 安全漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. Pimcore suffers from a CSV injection...

PT-2023-22475 · Unknown · Rosariosis

Name of the Vulnerable Software and Affected Versions: RosarioSIS version 10.8.4 Description: The issue concerns a CSV injection vulnerability via the Periods Module. Recommendations: For RosarioSIS version 10.8.4, consider disabling access to the Periods Module until a patch is available. At the...

RosarioSIS 安全漏洞

RosarioSIS is a free and open source student information system. It is used to manage students, create reports and make the right decisions. A security vulnerability exists in RosarioSIS version 10.8.4 that stems from a CSV injection in Periods Module...

ChurchCRM 安全漏洞

ChurchCRM is an open source CRM system for churches. ChurchCRM v4.5.3 suffers from a CSV injection vulnerability that stems from improperly neutralizing a formula element via the last name and first name input fields when creating a new account, which can be exploited by an attacker to execute...

The vulnerability of the FortiAnalyzer security event monitoring and analysis tool lies in the lack of a mechanism to neutralize elements in CSV files, allowing attackers to execute arbitrary code.

The vulnerability of the FortiAnalyzer event tracking and analysis tool lies in the absence of a mechanism to neutralize certain elements within the CSV file. Exploiting this vulnerability could allow an attacker to execute arbitrary code by inserting Excel formulas as names of macros within the...

Fortinet FortiAnalyzer 安全漏洞

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

SUSE CVE-2018-11652

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report...