{"cvss":0.0,"datePublished":"2013-10-26T00:00:00Z","dateUpdated":"2013-10-26T00:00:00Z","description":"TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.","dueDate":"","id":"CVE-2011-4106","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"timthumb","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"binarymoon timthumb Improper Input Validation","vendor":"binarymoon"}