CVE-2014-1843: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. dot dot in the src parameter...

PT-2014-4325

Name of the Vulnerable Software and Affected Versions Titan FTP Server versions prior to 10.40 build 1829 Description The issue allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter. This is a result of a directory traversal...

PT-2014-4327

Name of the Vulnerable Software and Affected Versions Titan FTP Server versions prior to 10.40 build 1829 Description The issue allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. dot dot in the src parameter. This is a director...

CVE-2014-1841: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter...

PT-2013-1421

Name of the Vulnerable Software and Affected Versions TimThumb timthumb.php versions prior to 2.0 Description The issue allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter. This is done by accessing the uploaded file via a...

CVE-2011-4106: Improper Input Validation

TimThumb timthumb.php before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache...

WordPress Multiple Plugin - timthumb.php Vulnerabilites

This Multiple plugin is prone to a timthumb.php library vulnerabilities. The attacker controls domain such as blogger.com by hosting a malicious GIF file with code that is appended to the end on. Then provides it to the script through the src GET parameter. Solution Upgrade the plugin...

CVE-2011-0772

Multiple cross-site scripting XSS vulnerabilities in PivotX 2.2.0, and possibly other versions before 2.2.2, allow remote attackers to inject arbitrary web script or HTML via the 1 color parameter to includes/blogroll.php or 2 src parameter to includes/timwrapper.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PivotX 2.2.0, and possibly other versions before 2.2.2, allow remote attackers to inject arbitrary web script or HTML via the 1 color parameter to includes/blogroll.php or 2 src parameter to includes/timwrapper.php...

PT-2011-2621

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.2.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the color parameter to "includes/blogroll.php" or the src parameter to "includes/timwrapper.php"...

CVE-2011-0772: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PivotX 2.2.0, and possibly other versions before 2.2.2, allow remote attackers to inject arbitrary web script or HTML via the 1 color parameter to includes/blogroll.php or 2 src parameter to includes/timwrapper.php...

KDE Konqueror DoS

Memory exhaustion on oversized SRC and HREF parameters...

CVE-2008-4522: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in JMweb MP3 Music Audio Search and Download Script allow remote attackers to include and execute arbitrary local files via a .. dot dot in the src parameter to 1 listen.php and 2 download.php...

CVE-2007-5318: Improper Input Validation

Unspecified vulnerability in preview.php in TYPOlight webCMS 2.4.6 allows remote attackers to download arbitrary files via the src parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6277: Undefined Security Weakness

Directory traversal vulnerability in admin/FileServer.php in ContentServ 4.x allows remote attackers to read arbitrary files via a .. dot dot in the src parameter, a different vector than CVE-2005-3086...

CVE-2006-4357: Undefined Security Weakness

PHP remote file inclusion vulnerability in clients/index.php in Diesel Smart Traffic allows remote attackers to execute arbitrary PHP code via a URL in the src parameter...

CVE-2005-3015

Cross-site scripting XSS vulnerability in IBM Lotus Domino 6.5.2 allows remote attackers to inject arbitrary web script or HTML via the 1 BaseTarget or 2 Src parameters...

CVE-2005-1282: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Argosoft Mail Server Pro 1.8.7.6 allow remote attackers to inject arbitrary web script or HTML via 1 the src parameter in an IMG tag, 2 User settings, or 3 Address book input boxes in the webmail interface...

CVE-2004-0501: Undefined Security Weakness

Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail message containing a Vector Markup Language VML entity whose src parameter points to the remote site, which could allow remote attackers to know whe...

CVE-2002-0902: Undefined Security Weakness

Cross-site scripting vulnerability in phpBB 2.0.0 phpBB2 allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote " in the IMG tag, which bypasses phpBB's security check, terminates the src parameter of the resulting HTML IMG tag, and injects th...