CVE-2020-15255

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-1236

Affected software

Vendor	Product	Versions
anuko	timetracker	< 1.19.23.5325

References

http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42fPatch, Third Party Advisory
https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpvThird Party Advisory
https://www.exploit-db.com/exploits/49027Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42fPatch, Third Party Advisory
https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpvThird Party Advisory
https://www.exploit-db.com/exploits/49027Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-152569.8A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to CVE-2020-152575.2containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 CVE-2020-152588.0In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. This vulnerability allows an attacker to execute code on the CVE-2020-152598.8ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execu CVE-2020-15267.8An elevation of privilege vulnerability exists when the Windows Network Connection Broker improperly handles memory. To exploit this vulnera CVE-2020-152606.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2020-152616.7On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with CVE-2020-152623.7In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by th CVE-2020-152636.1In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS CVE-2020-152647.8The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. Howe CVE-2020-152657.5In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`. This results CVE-2020-152667.5In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implement