openSUSE Security Update : MozillaThunderbird (openSUSE-2021-387)

This update for MozillaThunderbird fixes the following issues : - Mozilla Thunderbird 78.8 - fixed: Importing an address book from a CSV file always reported an error - fixed: Security information for S/MIME messages was not displayed correctly prior to a draft being saved - fixed: Calendar:...

CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files such as a data/settings/settings.xml file containing admin panel credentials, as demonstrated by dav/server.php/files/personal/%2e%2e when using the...

CentOS 8 : cyrus-imapd (CESA-2019:1771)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1771 advisory. - cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name CVE-2019-11356 Note that Nessus has not tested for this...

FreeBSD : glpi -- Any CalDAV calendars is read-only for every authenticated user (6a467439-3b38-11eb-af2a-080027dbe4b7)

MITRE Corporation reports : In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. This issue is fixed in version 9.5.3. As a workaround, one can remove the caldav.php file to block access to CalDAV server. C Tenable...

Security fix for the ALT Linux 10 package glpi version 9.5.3-alt1

Dec. 5, 2020 Pavel Zilke 9.5.3-alt1 - New version 9.5.3 - This is a security release, upgrading is recommended - Security fixes: + CVE-2020-27662 : Insecure Direct Object Reference on ajax/comments.php + CVE-2020-27663 : Insecure Direct Object Reference on ajax/getDropdownValue.php + CVE-2020-262...

CVE-2020-26212

GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of...

Design/Logic Flaw

GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of...

CVE-2020-26212 Any GLPI CalDAV calendars is read-only for every authenticated user

GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of...

CVE-2020-26212

Technical details about CVE-2020-26212 (affected GLPI versions, root cause, exploitability) are not present in the provided connected documents. The Initial Description notes the fix in 9.5.3 and a CalDAV workaround, but no further public details are available here. Monitor for updates.

PT-2020-16342 · Teclib +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.3 Description: The issue allows any authenticated user to have read-only permissions to the planning of every other user, including admin ones. This can be reproduced by creating a new planning, copying the CalDAV...

Arbitrary Code Execution

The CalDAV feature in httpd is vulnerable to arbitrary code execution. It allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name...

glpi -- Any CalDAV calendars is read-only for every authenticated user

MITRE Corporation reports: In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. This issue is fixed in version 9.5.3. As a workaround, one can remove the caldav.php file to block access to CalDAV server...

Fedora Update for cyrus-imapd FEDORA-2019-7938c21723

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: cyrus-imapd-3.0.13-1.fc31

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

Debian DSA-4582-1 : davical - security update

Multiple cross-site scripting and cross-site request forgery issues were discovered in the DAViCal CalDAV Server. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4582. The text itself is copyright C Software ...

Debian: Security Advisory (DLA-2034-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DAViCal CalDAV Server 1.1.8 Reflective Cross Site Scripting

Original text at: https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/ At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three severe vulnerabilities. We reported these...

DAViCal CalDAV Server 1.1.8 Cross Site Request Forgery

Original text at: https://hackdefense.com/publications/cve-2019-18346-davical-caldav-server-vulnerability/ At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three severe vulnerabilities. We reported these...

DAViCal CalDAV Server 1.1.8 Persistent Cross Site Scripting

Original text at: https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/ At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three severe vulnerabilities. We reported these...

[SECURITY] Fedora 31 Update: cyrus-imapd-3.0.12-1.fc31

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...