CVE-2020-15255

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-1236

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-152569.8A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to CVE-2020-152575.2containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9CVE-2020-152588.0In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. This vulnerability allows an attacker to execute code on the CVE-2020-152598.8ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execuCVE-2020-15267.8An elevation of privilege vulnerability exists when the Windows Network Connection Broker improperly handles memory. To exploit this vulneraCVE-2020-152606.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDCVE-2020-152616.7On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users withCVE-2020-152623.7In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by thCVE-2020-152636.1In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS CVE-2020-152647.8The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. HoweCVE-2020-152657.5In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`. This results CVE-2020-152667.5In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implement
CVE-2020-15255: High severity, CVSS 7.3 | Vulnix