CVE-2013-6919: Undefined Security Weakness

The default configuration of phpThumb before 1.7.12 has a false value for the disabledebug option, which allows remote attackers to conduct Server-Side Request Forgery SSRF attacks via the src parameter...

UBUNTU-CVE-2014-4465

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets CSS token sequences within an SVG file in the SRC attribute of an IMG element...

CVE-2014-4465: Improper Input Validation

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets CSS token sequences within an SVG file in the SRC attribute of an IMG element...

Minix 3.3.0 - Remote TCPIP Stack Denial of Service

Minix 3.3.0 - Remote TCPIP Stack Denial of Service / ------------------------------------------------------- ||------+ MINIX =--|| ||--= Nov 2014 =--|| ||--= Mexico =--|| -- MINIX IS PRONE TO DENIAL OF SERVICE IN THE TCP/IP STACK /service/inet BY SENDING A SINGLE TCP PACKET WITH A MALFORMED TCP...

PT-2014-8735

Name of the Vulnerable Software and Affected Versions DukaPress plugin versions prior to 2.5.4 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the dp img resize function. This is achieved by providing a .. dot dot in the src...

CVE-2014-6635

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php...

PT-2014-7314

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the src parameter in the "search" action to "index.php". Recommendations For Exponent CMS version 2.3.0,...

CVE-2014-6635: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php...

CVE-2014-1575: Undefined Security Weakness

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage...

PT-2014-4228

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 33.0 Description The issue is related to multiple unspecified vulnerabilities in the browser engine, allowing remote attackers to cause a denial of service, such as memory corruption and application crash, or...

Cross site scripting

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

CVE-2009-5142

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

PT-2014-2071

Name of the Vulnerable Software and Affected Versions TimThumb versions 1.09 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the src parameter in the timthumb.php file. This can be exploited by attackers to execute...

CVE-2009-5142: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection

The version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function 'ngxmailsmtpstarttls' within the file 'src/mail/ngxmailsmtphandler.c' whereby input t...

RokBox <= 2.13 - thumb.php src Parameter XSS

The wprokbox WordPress plugin was affected by a thumb.php src Parameter XSS security vulnerability...

TimThumb 'timthumb.php' < 2.8.14 WebShot 'src' Parameter Remote Command Execution

The TimThumb 'timthumb.php' script installed on the remote host is prior to version 2.8.14. It is, therefore, affected by a remote command execution vulnerability due to a failure to properly sanitize user-supplied input to the 'src' parameter. A remote, unauthenticated attacker can leverage this...

CVE-2014-4331: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/viewer.php in OctavoCMS allows remote attackers to inject arbitrary web script or HTML via the src parameter...

PT-2014-5815

Name of the Vulnerable Software and Affected Versions OctavoCMS affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the src parameter in the "admin/viewer.php" endpoint. Recommendations For all...

CVE-2014-4663: Improper Control of Generation of Code

TimThumb 2.8.13 and WordThumb 1.07, when Webshot aka Webshots is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter...