CWE-1236

Improper Neutralization of Formula Elements in a CSV File

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

298 vulnerabilities with CWE-1236
CVE-2019-20002 HIGH
SolarWinds WebHelpDesk 12.7.1 - Code Injection
CVSS 7.8
CVE-2019-19676 CRITICAL
arxes-tolina 3.0.0 - CSV Injection via Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung Columns
CVSS 9.6
CVE-2019-20184 HIGH
KeePass 2.4.1 - CSV Injection via Title Field in CSV Export
CVSS 7.8
CVE-2019-20180 MEDIUM
TablePress < 1.9.2 - CSV Injection via tablepress[data]
CVSS 6.8
CVE-2019-13181 MEDIUM
SolarWinds Serv-U FTP Server <15.1.7 - SQL Injection
CVSS 6.5
CVE-2019-0403 CRITICAL
SAP Enable Now < 1911 - CSV Command Injection
CVSS 9.8
CVE-2019-4521 CRITICAL
IBM Cloud Pak System <2.3 - Command Injection
CVSS 9.8
CVE-2019-6187 MEDIUM
Lenovo XClarity Controller - CSV Injection
CVSS 6.5
CVE-2019-17661 HIGH
codepress-admin-columns 3.4.6 - RCE
CVSS 8.8
CVE-2019-11275 MEDIUM
Pivotal Application Manager <670.0.7 - Command Injection
CVSS 4.3
CVE-2019-16184 CRITICAL
Limesurvey <3.17.14 - Command Injection
CVSS 9.8
CVE-2019-16120 HIGH
WordPress Event Tickets <4.10.7.2 - Code Injection
CVSS 8.8
CVE-2019-6182 MEDIUM
Lenovo XClarity Administrator <2.5.0 - CSV Injection
CVSS 4.9
CVE-2019-15092 HIGH
Webtoffee WordPress Users & WooCommerce Customers Import Export <1....
CVSS 7.3
CVE-2019-14749 HIGH
osTicket <1.10.7, <1.12.1 - Code Injection
CVSS 8.8
CVE-2019-14352 HIGH
Joget Workflow 6.0.20 - Code Injection
CVSS 7.8
CVE-2019-13144 CRITICAL
myTinyTodo 1.3.3-1.4.3 - CSV Injection
CVSS 9.8
CVE-2019-12961 HIGH
LiveZilla Server <8.0.1.1 - Code Injection
CVSS 8.8
CVE-2019-4364 HIGH
IBM Maximo Asset Mgmt <7.6 - Command Injection
CVSS 8.0
CVE-2019-12765 CRITICAL
Joomla! 3.9.0-3.9.6 - CSV Injection in com_actionlogs Export
CVSS 9.8
CVE-2019-12134 HIGH
Workday < 32.0 - CSV Injection via Export Feature
CVSS 8.8
CVE-2019-11872 HIGH
Hustle < 6.0.8.1 - CSV Injection via Pop-up Window Input
CVSS 8.8
CVE-2019-4071 HIGH
IBM Tivoli Storage Productivity Center <5.2.17 - Command Injection
CVSS 8.8
CVE-2019-11819 HIGH
Alkacon OpenCMS <10.5.4 - Code Injection
CVSS 7.8
CVE-2018-19855 MEDIUM
UiPath Orchestrator <2018.3.4 - Code Injection
CVSS 5.5
Details
Vulnerabilities 298
Links
MITRE CWE Entry Search this CWE With Exploits