Hardcoded credentials

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

PT-2020-9402

Name of the Vulnerable Software and Affected Versions: Simple Link Directory plugin versions prior to 7.3.5 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This is because the esc html function is not called for the echo get the title or echo $term-name...

U.S. Dept Of Defense: Second Order XSS via █████

Summary: A malicious user can use HTML injection to send a malicious chat message to an unsuspecting user, leading to a second order HTML injection/XSS via e-mail. Description: This will send an e-mail to the user that they have received a new message, and the malicious message will be sent to th...

GitLab HTML Injection Vulnerability (CNVD-2020-19602)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 12.5...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

Design/Logic Flaw

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5–12.8.1 contains an HTML injection vulnerability. The issue arises from unescaped input in a particular error header, potentially enabling injection or related issues. Affected product: GitLab (self-hosted) versions 12.5 through 12.8.1. Root cause: unescaped input in an error header le...

CVE-2020-10075

Removed by vendor...

PT-2020-11900 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.5 through 12.8.1 Description: The issue concerns HTML Injection in a particular error header, potentially allowing injection or other vulnerabilities via unescaped input. Recommendations: For versions 12.5 through 12.8.1,...

CVE-2020-10075: Improper Neutralization of Input During Web Page Generation

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10448

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-referrers.php by adding a question mark ? followed by the payload...

CVE-2020-10446

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-category.php by adding a question mark ? followed by the payload...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-subscribers.php by adding a question mark ? followed by the payload...

CVE-2020-10474

Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10449

CVE-2020-10449 is a reflected XSS in Chadha PHPKB Standard Multi-Language 9. The Red Hat advisories confirm the URI handling flaw in admin/header.php can trigger XSS by crafting a URI with a leading ? payload on specific admin pages (e.g., admin/report-search.php). The exact vulnerable endpoints ...

CVE-2020-10411

The CVE-2020-10411 issue affects Chadha PHPKB Standard Multi-Language 9. The root cause is improper handling of URIs in admin/header.php, enabling Reflected XSS by inserting a payload after a question mark in admin/indexed admin pages (e.g., admin/email-harvester.php per the Initial Description)....