Apache Directory Studio Command Injection

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet...

CVE-2022-24039

A vulnerability has been identified in Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2023-02194)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel. An attacker can exploit this vulnerability to execute arbitrary code on the system...

Microsoft Excel 代码注入漏洞

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel. An attacker can exploit this vulnerability to execute arbitrary code on the system...

@aqsc/form-making (>=0.0.22 <=0.0.39), @ariesate/are-components (=1.0.1) +78 more potentially affected by CVE-2022-25646 via x-data-spreadsheet (>=1.1.4 <=1.1.9)

x-data-spreadsheet NPM version =1.1.4, =0.0.22, =1.1.0, =1.1.5, =0.0.1, =0.0.1, =0.0.1, =1.0.1, =1.1.6, =0.0.1, =0.0.15 and more Source cves: CVE-2022-25646 Source advisory: SNYK:JS-XDATASPREADSHEET-2430381...

Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware

Researchers are tracking a number of open-source "protestware" projects on GitHub that have recently altered their code to display "Stand with Ukraine" messages for users, or basic facts about the carnage in Ukraine. The group also is tracking several code packages that were recently modified to...

Input validation

gradio is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, gradio suffers from Improper Neutralization of Formula Elements in a CSV File. The gradio library has a flagging functionality which saves input/output data into a CSV file on t...

CVE-2022-24770 Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging

gradio is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, gradio suffers from Improper Neutralization of Formula Elements in a CSV File. The gradio library has a flagging functionality which saves input/output data into a CSV file on t...

Security Bulletin: IBM Guardium Data Encryption (GDE) has a vulnerability (CVE-2021-39022), related to hazardous input.

Summary Vulnerability identified in IBM Guardium Data Encryption GDE, related to hazardous input. Please apply the latest version for the fixes. Vulnerability Details CVEID: CVE-2021-39022 DESCRIPTION: IBM Guardium Data Encryption GDE saves user-provided information into a Comma-Separated Value C...

CVE-2021-39022

IBM Guardium Data Encryption GDE 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. IBM X-Force ID...

CVE-2021-39022

IBM Guardium Data Encryption GDE 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. IBM X-Force ID...

WordPress Bulk Edit Posts and Products in Spreadsheet plugin < 2.24.13 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Bulk Edit Posts and Products in Spreadsheet plugin versions 2.24.13. Solution Update the WordPress Bulk Edit Posts and Products in Spreadsheet plugin to the latest available version at least 2.24.13...

WordPress Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins plugin <= 3.6.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. plugin versions = 3.6.0. Solution Update the WordPress Spreadsheet Integration – Automate Google Sheets With WordPress,...

WordPress Bulk Edit Posts and Products in Spreadsheet plugin < 2.24.13 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Bulk Edit Posts and Products in Spreadsheet plugin versions 2.24.13. Solution Update the WordPress Bulk Edit Posts and Products in Spreadsheet plugin to the latest available version at least 2.24.13...

WordPress Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins plugin <= 3.6.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins plugin versions = 3.6.0. Solution Update the WordPress Spreadsheet Integration – Automate Google...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2022-22710)

Microsoft Excel is an Office suite of spreadsheet processing software from the U.S. Microsoft Excel has an information disclosure vulnerability, and no details of the vulnerability are available...

Cross-site Scripting (XSS) - Reflected in phpipam/phpipam

Description Cross-Site Scripting vulnerability which allows attackers to execute arbitrary javascript code in the browser of a victim which affected import Data set feature via a spreadSheet file upload. Proof of Concept Endpoint 1 POST http://HOST/app/admin/import-export/import-vlan-preview.php ...

Spreadsheet Integration < 3.6.0 - Reflected Cross-Site Scripting

The plugin does not sanitise or escape some parameters before outputting them back in the admin dashboard, leading to reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=wpgsi=edit=1%22%3E%3Cimg+src+onerror%3Dalert%28%2FXSS%2F%29%3E POST...

Spreadsheet Integration < 3.6.0 - Reflected Cross-Site Scripting

The plugin does not sanitise or escape some parameters before outputting them back in the admin dashboard, leading to reflected Cross-Site Scripting issues https://example.com/wp-admin/admin.php?page=wpgsi&action=edit&id=1%22%3E%3Cimg+src+onerror%3Dalert%28%2FXSS%2F%29%3E POST...

Spreadsheet Integration < 3.6.0 - CSRF Bypass

The plugin does not properly check for CSRF in its wpgsiWorksheetColumnsTitle function, by making a request without the nonce parameter. This could allow attacker to make logged in admins call it...