CVE-2020-5722

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions befo...

Razer: HTML injection in support.razer.com [IE only]

The tester discovered the support.razer.com site had an HTML injection vulnerability that could have facilitated a phishing attack. Razer thanks the tester for his report and for working with the team to help remediate...

Hardcoded credentials

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi...

U.S. Dept Of Defense: Second Order XSS via █████

Summary: A malicious user can use HTML injection to send a malicious chat message to an unsuspecting user, leading to a second order HTML injection/XSS via e-mail. Description: This will send an e-mail to the user that they have received a new message, and the malicious message will be sent to th...

GitLab HTML Injection Vulnerability (CNVD-2020-19602)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 12.5...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

Design/Logic Flaw

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input...

CVE-2020-10075

Removed by vendor...

CVE-2020-10075

GitLab 12.5–12.8.1 contains an HTML injection vulnerability. The issue arises from unescaped input in a particular error header, potentially enabling injection or related issues. Affected product: GitLab (self-hosted) versions 12.5 through 12.8.1. Root cause: unescaped input in an error header le...

PT-2020-11900 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.5 through 12.8.1 Description: The issue concerns HTML Injection in a particular error header, potentially allowing injection or other vulnerabilities via unescaped input. Recommendations: For versions 12.5 through 12.8.1,...

CVE-2020-10446

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-category.php by adding a question mark ? followed by the payload...

CVE-2020-10448

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-referrers.php by adding a question mark ? followed by the payload...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-subscribers.php by adding a question mark ? followed by the payload...

CVE-2020-10474

Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10449

CVE-2020-10449 is a reflected XSS in Chadha PHPKB Standard Multi-Language 9. The Red Hat advisories confirm the URI handling flaw in admin/header.php can trigger XSS by crafting a URI with a leading ? payload on specific admin pages (e.g., admin/report-search.php). The exact vulnerable endpoints ...

CVE-2020-10411

The CVE-2020-10411 issue affects Chadha PHPKB Standard Multi-Language 9. The root cause is improper handling of URIs in admin/header.php, enabling Reflected XSS by inserting a payload after a question mark in admin/indexed admin pages (e.g., admin/email-harvester.php per the Initial Description)....

CVE-2020-10400

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/article-collaboration.php by adding a question mark ? followed by the payload...