CWE-1236

Improper Neutralization of Formula Elements in a CSV File

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

298 vulnerabilities with CWE-1236
CVE-2024-22063 HIGH
ZTE ZENIC ONE R58 - Command Injection
CVSS 7.6
CVE-2024-9102 MEDIUM
phpLDAPadmin <1.2.6.7 - CSV Formula Injection
CVE-2024-53921 LOW
Samsung Magician 8.1.0 - Path Traversal
CVSS 2.8
CVE-2024-53260 MEDIUM
Autolab < 3.0.2 - CSV Formula Injection via User Name Field
CVSS 6.8
CVE-2024-53555 HIGH
Taiga 6.8.1 - CSV Injection via Crafted File Upload
CVSS 8.8
CVE-2024-51094 HIGH
Snipe-IT <7.0.13 - Privilege Escalation
CVSS 8.0
CVE-2024-47485 CRITICAL
HikCentral Master Lite - Code Injection
CVSS 9.8
CVE-2024-27321 HIGH
Refuel Autolabel >= 0.0.8 - Remote Code Execution via Malicious CSV File in Multilabel Classification Task
CVSS 7.8
CVE-2024-27320 HIGH
Refuel Autolabel >= 0.0.8 - Remote Code Execution via Malicious CSV File
CVSS 7.8
CVE-2024-41226 HIGH
Automation Anywhere Automation 360 <21094 - Code Injection
CVSS 7.8
CVE-2024-3232 HIGH
Tenable Identity Exposure - Code Injection
CVSS 7.6
CVE-2024-27785 MEDIUM
Fortinet FortiAIOps 2.0.0 - Authenticated CSV Injection via Poisoned Reports
CVSS 5.4
CVE-2024-28764 MEDIUM
IBM WebSphere Automation 1.7.0 - Command Injection
CVSS 6.5
CVE-2024-3214 MEDIUM
Relevanssi - A Better Search <4.22.1 - Code Injection
CVSS 5.8
CVE-2024-25007 HIGH
Ericsson Network Manager <23.1 - XSS
CVSS 7.1
CVE-2024-29375 CRITICAL
Addactis IBNRS <3.10.3.107 - Code Injection
CVSS 9.8
CVE-2024-28111 MEDIUM
thinkst/canarytokens < sha-c595a1f8 - CSV Injection via Incident History Export
CVSS 6.5
CVE-2024-24337 HIGH
Koha Library Management System <23.05.05 - CSV Injection
CVSS 8.0
CVE-2023-54348 HIGH
ERPGo SaaS 3.9 CSV Injection via Vendor Creation
CVSS 8.8
CVE-2023-53929 HIGH
phpMyFAQ 3.1.12 - Authenticated CSV Injection via User Profile Export
CVSS 8.8
CVE-2023-53913 HIGH
Rukovoditel 3.3.1 - Authenticated CSV Injection via Firstname Field
CVSS 8.8
CVE-2023-53905 HIGH
ProjectSend r1605 - Authenticated CSV Injection via User Profile Name Field
CVSS 8.0
CVE-2023-47295 CRITICAL
NCR Terminal Handler 1.5.1 - Command Injection
CVSS 9.8
CVE-2023-51336 HIGH
PHPJabbers Meeting Room Booking System v1.0 - Code Injection
CVSS 8.8
CVE-2023-51333 HIGH
PHPJabbers Cinema Booking System v1.0 - Code Injection
CVSS 8.8
Details
Vulnerabilities 298
Links
MITRE CWE Entry Search this CWE With Exploits