TYPE DE FAIBLESSE
Injection CSV CWE-1236
126 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-1236 (en anglais) →
CVE-2021-23286Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton I…
5.7 MOYENNE
CVE-2021-23654This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while conver…
5.6 MOYENNE
CVE-2021-41270Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony…
6.5 MOYENNE
CVE-2021-36334Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading …
5.9 MOYENNE
CVE-2021-38424The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed whe…
5.9 MOYENNE
CVE-2021-37131There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operation…
6.8 MOYENNE
CVE-2021-1475Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and …
6.5 MOYENNE
CVE-2021-1474Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and …
6.5 MOYENNE
CVE-2021-27839A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or h…
4.4 MOYENNE
CVE-2021-21302PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via…
6.8 MOYENNE
CVE-2020-9205There has a CSV injection vulnerability in ManageOne 8.0.1. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to…
4.9 MOYENNE
CVE-2019-16959SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.
6.5 MOYENNE
CVE-2020-28861OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access …
5.3 MOYENNE
CVE-2020-4689IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file co…
6.8 MOYENNE
CVE-2020-16214In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the
software saves user-provided information into a comma-separated value
(CSV) file, but it does not neutrali…
5.0 MOYENNE
CVE-2020-10780Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the…
6.3 MOYENNE
CVE-2020-10460admin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST para…
4.9 MOYENNE
CVE-2020-9466The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
6.1 MOYENNE
CVE-2019-20180The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with …
6.8 MOYENNE
CVE-2019-13181A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.
6.5 MOYENNE
CVE-2019-6187A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed…
6.5 MOYENNE
CVE-2019-11275Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and ver…
4.3 MOYENNE
CVE-2019-6182A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to store malformed data in…
4.9 MOYENNE
CVE-2018-19855UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
5.5 MOYENNE
CVE-2018-12244SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a typ…
6.3 MOYENNE
CVE-2018-9137Open-AudIT before 2.2 has CSV Injection.
6.8 MOYENNE