https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:26:17 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-03898 bdu:2020-03898 https://cve.radiocsirt.org/vuln/bdu:2020-03898 https://cve.radiocsirt.org/vuln/euvd-2026-40108 EUVD-2026-40108 https://cve.radiocsirt.org/vuln/euvd-2026-40108 https://cve.radiocsirt.org/vuln/fkie_cve-2020-10780 <p>Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.</p> <p>Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-10780 https://cve.radiocsirt.org/vuln/gsd-2020-10780 gsd-2020-10780 https://cve.radiocsirt.org/vuln/gsd-2020-10780 https://cve.radiocsirt.org/vuln/rhsa-2020:3358 <p>CloudForms: Cross Site Scripting in report menu title / HTML Code Injection CloudForms: Business logic bypass through widgets CloudForms: Missing functional level access control &amp; IDOR lead to compromise CloudForms: CSV Injection in Orchestration Templates CloudForms: Missing access control leads to escalation of admin group privileges CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider CloudForms: Out-of-band OS Command Injection through conversion host CloudForms: User Impersonation in the API for OIDC and SAML</p> <p>CloudForms: Cross Site Scripting in report menu title / HTML Code Injection CloudForms: Business logic bypass through widgets CloudForms: Missing functional level access control &amp; IDOR lead to compromise CloudForms: CSV Injection in Orchestration Templates CloudForms: Missing access control leads to escalation of admin group privileges CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider CloudForms: Out-of-band OS Command Injection through conversion host CloudForms: User Impersonation in the API for OIDC and SAML</p> https://cve.radiocsirt.org/vuln/rhsa-2020:3358