GitLab HTML Injection Vulnerability (CNVD-2020-19602)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 12.5...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

Design/Logic Flaw

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

Removed by vendor...

CVE-2020-10075

GitLab 12.5–12.8.1 contains an HTML injection vulnerability. The issue arises from unescaped input in a particular error header, potentially enabling injection or related issues. Affected product: GitLab (self-hosted) versions 12.5 through 12.8.1. Root cause: unescaped input in an error header le...

PT-2020-11900 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.5 through 12.8.1 Description: The issue concerns HTML Injection in a particular error header, potentially allowing injection or other vulnerabilities via unescaped input. Recommendations: For versions 12.5 through 12.8.1,...

CVE-2020-10446

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-category.php by adding a question mark ? followed by the payload...

CVE-2020-10448

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-referrers.php by adding a question mark ? followed by the payload...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-subscribers.php by adding a question mark ? followed by the payload...

CVE-2020-10474

Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10449

CVE-2020-10449 is a reflected XSS in Chadha PHPKB Standard Multi-Language 9. The Red Hat advisories confirm the URI handling flaw in admin/header.php can trigger XSS by crafting a URI with a leading ? payload on specific admin pages (e.g., admin/report-search.php). The exact vulnerable endpoints ...

CVE-2020-10411

The CVE-2020-10411 issue affects Chadha PHPKB Standard Multi-Language 9. The root cause is improper handling of URIs in admin/header.php, enabling Reflected XSS by inserting a payload after a question mark in admin/indexed admin pages (e.g., admin/email-harvester.php per the Initial Description)....

CVE-2020-10400

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/article-collaboration.php by adding a question mark ? followed by the payload...

CVE-2020-9440

A cross-site scripting XSS vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor...

CVE-2020-9371

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabcappointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML...

CVE-2020-9371

The CVE refers to the WordPress plugin Appointment Booking Calendar (cpabc_appointments.php). A Stored XSS exists in the Calendar Name input, allowing injection of arbitrary JavaScript/HTML in versions prior to 1.3.35. The vulnerability is triggered through normal admin functionality when creatin...

RICOH Aficio SP 5210SF Printer - 'entryNameIn' HTML Injection

Exploit Title: RICOH Aficio SP 5210SF Printer - 'entryNameIn' HTML Injection Discovery by: Olga Villagran Discovery Date: 2020-03-02 Vendor Homepage: https://www.ricoh.com/ Hardware Link: http://support.ricoh.com/bb/html/drute/rc3/model/sp52s/sp52s.htm?lang=es Product Version: RICOH Aficio SP...