Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-1774 1 Ibm 1 Api Connect 2024-11-21 N/A
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692.
CVE-2018-19855 1 Uipath 1 Orchestrator 2024-11-21 N/A
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
CVE-2018-16962 2 Apple, Webroot 2 Macos, Secureanywhere 2024-11-21 N/A
Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.
CVE-2018-16651 1 Phpmyfaq 1 Phpmyfaq 2024-11-21 N/A
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
CVE-2018-16308 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
CVE-2018-16275 1 Opswat 1 Metadefender 2024-11-21 N/A
OPSWAT MetaDefender before v4.11.2 allows CSV injection.
CVE-2018-15571 1 Export Users To Csv Project 1 Export Users To Csv 2024-11-21 N/A
The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.
CVE-2018-15474 1 Dokuwiki 1 Dokuwiki 2024-11-21 N/A
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki.
CVE-2018-12244 1 Symantec 1 Endpoint Protection 2024-11-21 N/A
SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a type of issue whereby an application or website allows untrusted input into CSV files.
CVE-2018-12036 1 Owasp 1 Dependency-check 2024-11-21 N/A
OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
CVE-2018-11652 1 Cirt.net 1 Nikto 2024-11-21 N/A
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.
CVE-2018-11526 1 Webtoffee 1 Wordpress Comments Import And Export 2024-11-21 N/A
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
CVE-2018-11525 1 Algolplus 1 Advanced Order Export For Woocommerce 2024-11-21 N/A
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
CVE-2018-10504 1 Web-dorado 1 Form Maker 2024-11-21 N/A
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
CVE-2018-10258 1 Codeslab 1 Shopy Point Of Sale 2024-11-21 N/A
A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
CVE-2018-10257 1 Hrsale Project 1 Hrsale 2024-11-21 N/A
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
CVE-2018-10255 1 Clustercoding 1 Blog Master Pro 2024-11-21 8.8 High
A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
CVE-2017-6282 2 Google, Nvidia 3 Android, Shield Tv, Shield Tv Firmware 2024-11-21 N/A
NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary location which may lead to an escalation of privileges. This issue is rated as high.
CVE-2014-5435 1 Honeywell 1 Experion Process Knowledge System 2024-11-21 N/A
An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
CVE-2024-47438 1 Adobe 1 Substance 3d Painter 2024-11-13 5.5 Medium
Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memory content. Exploitation of this issue requires user interaction in that a victim must open a malicious file.