16119 matches found
CVE-2020-5722
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions befo...
CVE-2019-15510
ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...
CVE-2019-15510
ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...
Design/Logic Flaw
ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...
CVE-2019-15510
Zoho ManageEngine Desktop Central 10 is affected by an HTML-injection vulnerability in the user administration page. The root cause is unsanitized input in the role description field during role creation, which can be reflected on the page and potentially executed in the user’s context. Affected ...
CVE-2019-15510
ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...
PT-2020-9704 · Zoho · Zoho Manageengine Desktop Central
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Desktop Central version 10 Description: The issue allows HTML injection on the user administration page via the description of a role. This is achieved by exploiting the description variable in the role creation process. The...
CVE-2020-5722
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions befo...
Razer: HTML injection in support.razer.com [IE only]
The tester discovered the support.razer.com site had an HTML injection vulnerability that could have facilitated a phishing attack. Razer thanks the tester for his report and for working with the team to help remediate...
Hardcoded credentials
Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...
U.S. Dept Of Defense: Second Order XSS via █████
Summary: A malicious user can use HTML injection to send a malicious chat message to an unsuspecting user, leading to a second order HTML injection/XSS via e-mail. Description: This will send an e-mail to the user that they have received a new message, and the malicious message will be sent to th...
GitLab HTML Injection Vulnerability (CNVD-2020-19602)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 12.5...
CVE-2020-10075
GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...
CVE-2020-10075
GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...
CVE-2020-10075
GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...
Design/Logic Flaw
GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...
CVE-2020-10075
GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...
CVE-2020-10075
Removed by vendor...
CVE-2020-10075
GitLab 12.5–12.8.1 contains an HTML injection vulnerability. The issue arises from unescaped input in a particular error header, potentially enabling injection or related issues. Affected product: GitLab (self-hosted) versions 12.5 through 12.8.1. Root cause: unescaped input in an error header le...
PT-2020-11900 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.5 through 12.8.1 Description: The issue concerns HTML Injection in a particular error header, potentially allowing injection or other vulnerabilities via unescaped input. Recommendations: For versions 12.5 through 12.8.1,...