PT-2017-19015

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.0-3414 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the image parameter in...

CVE-2017-9555: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Gratipay: Application-level DoS on image's "size" parameter.

Summary --- The size parameter located on images is vulnerable to DoS. By modifying the parameter's value an attacker can cause the application to work very slowly. Description --- The issue is located in the getimageurl function in gratipay/models/team/init.py and can be exploited by replacing t...

Code injection

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8706: Exposure of Sensitive Information to an Unauthorized Actor

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

DouPHP admin/article.php image parameter SQL injection

No description provided by source...

CVE-2014-9562

Cross-site scripting XSS vulnerability in displaydialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in displaydialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

PT-2015-4275

Name of the Vulnerable Software and Affected Versions M2 OptimalSite versions 0.1 through 2.4 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the image parameter in the display dialog.php file...

CVE-2014-9562: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in displaydialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

CVE-2013-3650

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LCPageResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resizeimage.php, a different vulnerability than...

CVE-2013-3650: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LCPageResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resizeimage.php, a different vulnerability than...

Oracle Java SE Multiple Vulnerabilities -01 March 13 (Windows)

This host is installed with Oracle Java SE and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gboraclejavasemultvuln01mar13win.nasl 7699 2017-11-08 12:10:34Z santu $ Oracle Java SE Multiple Vulnerabilities -01 March 13 Windows Authors: Arun Kallavi Copyright: Copyright c 20...

Cross site scripting

Cross-site scripting XSS vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the imageid parameter...

CVE-2010-4909: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PaysiteReviewCMS 1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 q parameter to search.php or the 2 image parameter to image.php...

CVE-2011-0773

Cross-site scripting XSS vulnerability in pivotx/modules/moduleimage.php in PivotX before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

PT-2011-2622

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.2.3 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the image parameter in the pivotx/modules/module image.php file. Recommendations For...

PT-2011-2624

Name of the Vulnerable Software and Affected Versions PivotX version 2.2.2 Description The issue allows remote attackers to obtain sensitive information via a non-existent file in the image parameter. This is achieved by exploiting the pivotx/modules/module image.php file, which reveals the...

CVE-2011-0773: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in pivotx/modules/moduleimage.php in PivotX before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

CVE-2011-0775: Exposure of Sensitive Information to an Unauthorized Actor

pivotx/modules/moduleimage.php in PivotX 2.2.2 allows remote attackers to obtain sensitive information via a non-existent file in the image parameter, which reveals the installation path in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from...