PT-2018-18756

Name of the Vulnerable Software and Affected Versions Open-AudIT Professional version 2.1 Description The issue is related to a crafted src attribute of an IMG element within a URI, which can lead to XSS. Recommendations For Open-AudIT Professional version 2.1, consider validating and sanitizing...

CVE-2018-8978: Improper Neutralization of Input During Web Page Generation

Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI...

CVE-2017-18175: Improper Neutralization of Input During Web Page Generation

Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration aka Templateconfiguration, as demonstrated by the src attribute of an IMG element. This is fixed in 10.1...

UBUNTU-CVE-2018-6790

An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element...

PT-2018-17746

Name of the Vulnerable Software and Affected Versions KDE Plasma Workspace versions prior to 5.12.0 Description An issue in the notifications engine allows remote attackers to discover client IP addresses via a URL in a notification. This can be achieved by using the src attribute of an IMG...

CVE-2018-6360: Improper Input Validation

mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. For example, an av://lavfi:ladspa=file= UR...

CVE-2017-15008

PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error handling for a %00 in the SRC attribute of an IMG element...

CVE-2017-15008: Improper Neutralization of Input During Web Page Generation

PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error handling for a %00 in the SRC attribute of an IMG element...

PT-2017-13812

Name of the Vulnerable Software and Affected Versions PRTG Network Monitor version 17.3.33.2830 Description The issue is related to stored Cross-Site Scripting on all sensor titles, due to incorrect error handling for a %00 in the SRC attribute of an IMG element. Recommendations For version...

CVE-2017-14744

UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element...

CVE-2017-14744

UEditor 1.4.3.3 is vulnerable to cross-site scripting via the SRC attribute of an IFRAME element. The issue is documented across multiple sources (NVD, CNVD, Red Hat, CVE lists) and is consistently described as an XSS in Baidu/UEditor, with no explicit remediation or patch version provided in the...

CVE-2017-14744: Improper Neutralization of Input During Web Page Generation

UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element...

PT-2017-13663

Name of the Vulnerable Software and Affected Versions UEditor version 1.4.3.3 Description The issue is related to a cross-site scripting XSS problem. It occurs via the SRC attribute of an IFRAME element. Recommendations For UEditor version 1.4.3.3, update to a newer version that contains a fix fo...

CVE-2016-5283

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized...

CVE-2016-5283

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized...

CVE-2016-5283

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized...

CVE-2016-5283: Improper Access Control

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized...

PT-2016-6341

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 49.0 Description The issue allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element. This leads to insufficient restrictions on...

CVE-2014-4465: Improper Input Validation

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets CSS token sequences within an SVG file in the SRC attribute of an IMG element...

CVE-2014-2994

Stack-based buffer overflow in Acunetix Web Vulnerability Scanner WVS 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL src attribute...