Calendar by WD <= 1.5.51 - Authenticated SQL injection

http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar&task=showmanageevent&calendarid=1 Vulnerable POST Body:...

CVE-2017-2151

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2150

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captchachalange parameter...

CVE-2017-2151

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2150

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captchachalange parameter...

Cross site scripting

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2150

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captchachalange parameter...

CVE-2017-2150

The CVE-2017-2150 entry concerns the WordPress plugin Booking Calendar (versions 7.0 and earlier). Affected component: the Booking Calendar plugin’s captcha_chalange handling. Root cause: directory traversal vulnerability that enables a remote attacker to read arbitrary files by crafting the inpu...

CVE-2017-2151

The CVE-2017-2151 entry concerns the WordPress plugin Booking Calendar (versions 7.1 and earlier). The vulnerability is a stored cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML/script via unspecified vectors, potentially executing in a user’s browser. Affecte...

CVE-2017-2151

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

WordPress plugin "Booking Calendar" vulnerable to cross-site scripting

Overview The WordPress plugin "Booking Calendar" provided by wpdevelop contains a stored cross-site scripting vulnerability CWE-79. Satoshi Takagi of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported this vulnerability to IPA. JPCERT/C...

WordPress plugin "Booking Calendar" vulnerable to directory traversal

Overview The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A local file outside of th...

JVN#54762089: WordPress plugin "Booking Calendar" vulnerable to cross-site scripting

The WordPress plugin "Booking Calendar" provided by wpdevelop contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of a user accessing the page generated by the application. Solution Update the Software Update to the latest...

JVN#18739672: WordPress plugin "Booking Calendar" vulnerable to directory traversal

The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. Impact A local file outside of the application on the server may be accessed by a remote attacker. Solution Update the Software Update to the latest version according to the...

Open-Xchange: Critical : View/Edit access to private appointments of calendar folder by read only user (Vertical privilege escalation)

Hi Team, Description : Read only user of calendar folder shouldn't be able access any private appointments. I have found a move calendar folder request which is working for read only user. Once Attacker moves the appointment to his folder , then he can Access private appointments. Vulnerable HTTP...

Open-Xchange: Unauthorized access to attachments details of Private Calendar appointments (Access control issue)

Hi Team, Description : In calendar folder there is a permission settings where user can be assigned as read only user of it's own objects . User with this permission shouldn't be able to view private appointments and it's attachments . There is request of getting attachment details from server...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

Sql injection

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

CVE-2017-7719

CVE-2017-7719 : SQL injection in the WordPress plugin Spider Event Calendar (aka spider-event-calendar) before 1.5.52. An attacker can abuse the order_by parameter in the filescalendar_functions.php or widget_Theme_functions.php , related to front_end/frontend_functions.php , to execute arbitrary...