Openasset Cross-Site Scripting Vulnerability

Openasset is a digital asset management software for the website builder industry from Openasset UK. A cross-site scripting vulnerability exists in OpenAsset Digital Asset Management that stems from the web application providing several endpoints that allow unauthenticated data retrieval. For...

C2FO Fast-csv Resource Management Error Vulnerability

C2FO Fast-csv is a Typescript-based code library for parsing and formatting CSV-formatted files from Packwood C2FO. A security vulnerability exists in Fast-csv, which stems from a possible re-dos vulnerability regular expression denial of service when parsing with the ignoreEmpty option...

IBM Cloud Pak for Security Injection Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. An injection vulnerability exists in IBM Cloud Pak for Security, which is caus...

IBM Cloud Pak for Security 注入漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. An injection vulnerability exists in IBM Cloud Pak for Security, which is caus...

Netskope Injection Vulnerability

Netskope is a threat protection gateway for cloud environments from US-based Netskope. An injection vulnerability exists in Netskope version 75.0, which stems from a CSV injection vulnerability that can be exploited by an attacker to inject a malicious payload into an administrator's portal,...

SuiteCRM 安全漏洞

SuiteCRM is a free open source customer relationship management application. A CSV injection vulnerability exists in SuiteCRM 7.11.13 and earlier versions. The vulnerability can be exploited to conduct CSV injection attacks via the registration field in the Accounts, Contacts, Opportunities, and...

IBM FileNet Content Manager CSV Injection Vulnerability

IBM FileNet Content Manager is a comprehensive enterprise content management ECM solution that uniquely combines content management with out-of-the-box workflow processes to help organizations manage complex documents and control, share and quickly access critical business information. A CSV...

CVE-2020-4759

IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

CVE-2020-22275

Easy Registration Forms ER Forms Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable...

UBUNTU-CVE-2020-22278

DISPUTED phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents."...

CVE-2020-27358

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature that allows users to export their conversation threads as CSV allows non-privileged users to export one another's conversation threads by changing the threadid parameter in the request to the endpoint...

Anuko Time Tracker Injection Vulnerability

Anuko Time Tracker is an open source time counting system for individual developers. A platform for counting the time spent by employees on various tasks. A security vulnerability exists in versions prior to Anuko Time Tracker 1.19.23.5325, which stems from a failure to properly filter user input...

CVE-2020-4689

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

CVE-2020-4302

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID:...

Ozeki NG SMS Gateway CSV Injection Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A CSV injection vulnerability exists in the "Contact Export" feature in Ozeki NG SMS Gateway 4.17.6 and earlier versions. The vulnerability can be exploited to run commands on the victim computer on behalf of the...

CVE-2020-16214

In Patient Information Center iX PICiX Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadshee...

CVE-2020-24898

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

CVE-2020-13826

A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...

CloudForms: CSV Injection in Orchestration Templates

A flaw was found in Orchestration Template of Red Hat CloudForms where a low privilege user could enter crafted CSV formulae. Successful exploitation will allow an attacker to execute arbitrary code with the privilege of currently logged in user of the system causing serious damage to the victim’...