Filtered by CWE-1236
Filtered by vendor Subscriptions
Total 260 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-42004 1 Ibm 1 Security Guardium 2024-11-21 8 High
IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper validation of csv file contents. IBM X-Force ID: 265262.
CVE-2024-3232 2024-11-21 7.6 High
A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232
CVE-2024-27785 1 Fortinet 1 Fortiaiops 2024-11-21 5.1 Medium
An improper neutralization of formula elements in a CSV File vulnerability [CWE-1236] in FortiAIOps version 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports.
CVE-2024-25007 1 Ericsson 1 Network Manager 2024-11-21 7.1 High
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.
CVE-2023-5527 1 Businessdirectoryplugin 1 Business Directory 2024-11-21 7.4 High
The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by administrators, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVE-2023-5424 1 Westguardsolutions 1 Ws Form 2024-11-21 4.7 Medium
The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVE-2023-51763 1 Activeadmin 1 Active Admin 2024-11-21 9.8 Critical
csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.
CVE-2023-50448 1 Activeadmin 1 Activeadmin 2024-11-21 6.5 Medium
In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.
CVE-2023-4006 1 Phpmyfaq 1 Phpmyfaq 2024-11-21 9.8 Critical
Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
CVE-2023-48207 1 Phpjabbers 1 Availability Booking Calendar 2024-11-21 8.8 High
Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component.
CVE-2023-47534 1 Fortinet 1 Forticlient Endpoint Management Server 2024-11-21 8.7 High
A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVE-2023-43071 1 Dell 1 Smartfabric Storage Software 2024-11-21 4.4 Medium
Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to various injection type attacks.
CVE-2023-3527 1 Avaya 1 Call Management System 2024-11-21 6.8 Medium
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.  
CVE-2023-3493 1 Fossbilling 1 Fossbilling 2024-11-21 8.0 High
Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.
CVE-2023-3302 1 Admidio 1 Admidio 2024-11-21 7.8 High
Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
CVE-2023-38843 1 Atlos 1 Atlos 2024-11-21 8.0 High
An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function.
CVE-2023-37219 1 Tadirantele 1 Aeonix 2024-11-21 7.3 High
Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
CVE-2023-36527 1 Bestwebsoft 1 Post To Csv 2024-11-21 8.8 High
Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.
CVE-2023-31296 1 Sesami 1 Cash Point \& Transport Optimizer 2024-11-21 5.3 Medium
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.
CVE-2023-31295 1 Sesami 1 Cash Point \& Transport Optimizer 2024-11-21 7.5 High
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the User Profile field.