CVE-2016-1000222

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published
Jun 16, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-10002296.1swagger-ui has XSS in key namesCVE-2016-10002325.3NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result CVE-2016-10002364.4Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.CVE-2016-10002376.1sanitize-html before 1.4.3 has XSS.CVE-2016-10002719.8Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=caCVE-2016-10002829.8Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable CVE-2016-100037.5Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed ForwardinCVE-2016-10003076.1Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web sCVE-2016-10003387.5In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is poCVE-2016-10003395.3In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table CVE-2016-10003407.5In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for severaCVE-2016-10003415.9In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be clo
CVE-2016-1000222: High severity, CVSS 7.5 | Vulnix