Cross site scripting

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

CVE-2009-5142

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

PT-2014-2071

Name of the Vulnerable Software and Affected Versions TimThumb versions 1.09 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the src parameter in the timthumb.php file. This can be exploited by attackers to execute...

CVE-2009-5142: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection

The version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function 'ngxmailsmtpstarttls' within the file 'src/mail/ngxmailsmtphandler.c' whereby input t...

RokBox <= 2.13 - thumb.php src Parameter XSS

The wprokbox WordPress plugin was affected by a thumb.php src Parameter XSS security vulnerability...

TimThumb 'timthumb.php' < 2.8.14 WebShot 'src' Parameter Remote Command Execution

The TimThumb 'timthumb.php' script installed on the remote host is prior to version 2.8.14. It is, therefore, affected by a remote command execution vulnerability due to a failure to properly sanitize user-supplied input to the 'src' parameter. A remote, unauthenticated attacker can leverage this...

CVE-2014-4331: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/viewer.php in OctavoCMS allows remote attackers to inject arbitrary web script or HTML via the src parameter...

PT-2014-5815

Name of the Vulnerable Software and Affected Versions OctavoCMS affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the src parameter in the "admin/viewer.php" endpoint. Recommendations For all...

CVE-2014-4663: Improper Control of Generation of Code

TimThumb 2.8.13 and WordThumb 1.07, when Webshot aka Webshots is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter...

PT-2014-6048

Name of the Vulnerable Software and Affected Versions TimThumb version 2.8.13 WordThumb version 1.07 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter when Webshot also known as Webshots is enabled. Recommendations For TimThu...

Medium: php54

Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...

OctavoCMS Cross Site Scripting

This proprietary content management software is vulnerable to reflected XSS on the file admin/viewer.php, src parameter. Current release on their demo site is vulnerable, same as other few sites I could find. PoC:...

IBM HomePagePrint 1.0 7 Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/763/info Certain versions of the IBM Web page printout software IBM HomePagePrint can in some instances be remotely exploited by malicious webservers. The problem lies in a buffer overflow in the code which handles IMGSRC...

Kmail <= 1.9.1 (IMG SRC) Remote Denial of Service Vulnerability

No description provided by source. nnp at silenthack.co.uk http://silenthack.co.uk Kmail = 1.9.1 latest suffers from a crash when trying to parse an incorrectly formatted img tag. HTML parsing must be enabled for this. This can be done by going to Settings - Configure Kmail -Security - and tick...

imacs CMS 0.3.0 - Unrestricted File Upload Exploit

No description provided by source. ?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : imacs CMS...

MS IE 4/5/5.5/5.0.1 external.NavigateAndFind() Cross-Frame Vulnerability

No description provided by source. Microsoft Internet Explorer 4.0 for WfW/Windows 3.1/Windows 95/Windows NT 3/Windows NT 4,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5,Internet Explorer 5.0.1,Internet Explorer for Unix 5.0 external.NavigateAndFi...

Adobe SVG Viewer 3.0 ActiveX Control SRC Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13490/info The Adobe SVG Viewer ActiveX control is prone to an information disclosure vulnerability. Reports indicate that the Adobe SVG Viewer ActiveX control may be employed to disclose the existence of a target file...

AOL Products downloadUpdater2 Plugin SRC Parameter Remote Code Execution

No description provided by source. AOL Products downloadUpdater2 Plugin SRC Parameter Remote Code Execution tested against: Microsoft Windows Vista sp2 Microsoft Windows Server 2003 r2 sp2 Mozilla Firefox 14.0.1 download url:...

Vanilla Forums Van2Shout Plugin 1.0.51 - Multiple CSRF Vulnerabilities

No description provided by source. Exploit Title: Vanilla Forums = 2.0.18.8 & Van2Shout 1.0.51 Multiple CSRF Google Dork: n/a Date: 13/4/13 Exploit Author: Henry Hoggard Vendor Homepage: http://vanillaforums.org/ , http://vanillaforums.org/addon/van2shout-plugin Software Link:...