CVE-2010-1854

Cross-site scripting XSS vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the idauk parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; th...

CVE-2010-1855

SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the idauk parameter...

CVE-2010-1854

CVE-2010-1854 concerns an XSS in auktion.php of Pay Per Watch & Bid Auktions System, exploitable through the id_auk parameter, where an injected script/HTML appears in a forced SQL error message. Related records (NVD/Red Hat) confirm this vulnerability and its association to CVE-2010-1855 (SQL in...

CVE-2010-1854

Cross-site scripting XSS vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the idauk parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; th...

CVE-2010-1855: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the idauk parameter...

CVE-2010-1854: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the idauk parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; th...

[Backports-security-announce] Security update for devscripts

Adam D. Barratt uploaded new packages for devscripts which fixed the following security problem: CVE-2009-2946: When parsing watch files, uscan applied "mangle rules" by evaluating them as Perl code without any sanitisation. This could have lead to the execution of arbitrary code by users or...

[Backports-security-announce] Security update for devscripts

Adam D. Barratt uploaded new packages for devscripts which fixed the following security problem: CVE-2009-2946: When parsing watch files, uscan applied "mangle rules" by evaluating them as Perl code without any sanitisation. This could have lead to the execution of arbitrary code by users or...

CVE-2009-3066

Multiple cross-site scripting XSS vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 videoid parameter to tools/email.php and 2 redirect parameter to tools/login.php...

CVE-2009-3066

CVE-2009-3066 describes multiple cross-site scripting (XSS) vulnerabilities in PropertyWatchScript.com Property Watch 2.0. The affected vectors are: (1) the videoid parameter to tools/email.php and (2) the redirect parameter to tools/login.php, enabling remote attackers to inject arbitrary web sc...

CVE-2009-3066

Multiple cross-site scripting XSS vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 videoid parameter to tools/email.php and 2 redirect parameter to tools/login.php...

CVE-2009-3066: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 videoid parameter to tools/email.php and 2 redirect parameter to tools/login.php...

[Backports-security-announce] Security update for devscripts

Adam D. Barratt uploaded new packages for devscripts which fixed the following security problem: CVE-2009-2946: When parsing watch files, uscan applied "mangle rules" by evaluating them as Perl code without any sanitisation. This could have lead to the execution of arbitrary code by users or...

Property Watch 2.0 Cross Site Scripting

/ | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || Property Watch v2.0 Remote XSS Vulnerabilities Discovered By : Moudi Contact : Download : http://www.propertywatchscript.com/ Greetings :...

Property Watch - 'email.php?videoid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/42453/info Property Watch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in...

Property Watch - email.php?videoid Cross-Site Scripting

Property Watch - email.php?videoid Cross-Site Scripting source: https://www.securityfocus.com/bid/42453/info Property Watch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitra...

Property Watch - login.php?redirect Cross-Site Scripting

Property Watch - login.php?redirect Cross-Site Scripting source: https://www.securityfocus.com/bid/42453/info Property Watch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

Property Watch - 'login.php?redirect' Cross-Site Scripting

source: https://www.securityfocus.com/bid/42453/info Property Watch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in...

Mozilla remote code execution using watch and __defineSetter__ on SVG element

Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an defineSetter function, which allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via a crafted documen...

Memory corruption

The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via 1 a splice of an array that contains "some non-set elements," which causes jsarray.cpp to pas...