WordPress Multi View Event Calendar SQL Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

WordPress Plugin CP Multi View Event Calendar 1.01 - SQL Injection

WordPress Plugin CP Multi View Event Calendar 1.01 - SQL Injection Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/cp-multi-view-calendar.zip Date : 2014-10-23 Tested on : Windows...

WordPress Plugin CP Multi View Event Calendar 1.01 - SQL Injection

Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/cp-multi-view-calendar.zip Date : 2014-10-23 Tested on : Windows 7 / Mozilla Firefox Windows 7 / sqlmap 0.8-1 Linux / Mozilla Firef...

CP Multi View Event Calendar <= 1.0.1 - SQL Injection

The Calendar Event Multi View WordPress plugin was affected by a SQL Injection security vulnerability...

WordPress CP Multi View Event Calendar 1.01 SQL Injection Vulnerability

WordPress CP Multi View Event Calendar plugin version 1.01 suffers from a remote SQL injection vulnerability. Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability Exploit Author : Claudio Viviani Software Link :...

WordPress CP Multi View Event Calendar 1.01 SQL Injection

Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/cp-multi-view-calendar.zip Date : 2014-10-23 Tested on : Windows 7 / Mozilla Firefox Windows 7 / sqlmap 0.8-1 Linux / Mozilla...

CVE-2014-8325

The Calendar Base cal extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service resource consumption via vectors related to the PHP PCRE library...

Code injection

The Calendar Base cal extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service resource consumption via vectors related to the PHP PCRE library...

CVE-2014-8325

CVE-2014-8325 affects the TYPO3 Calendar Base (cal) extension. The vulnerability arises when user input is passed to PHP’s PCRE library without validation, enabling remote attackers to cause a denial of service through resource consumption. Affected are TYPO3 cal versions before 1.5.9 and 1.6.x b...

CVE-2014-8325

The Calendar Base cal extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service resource consumption via vectors related to the PHP PCRE library...

CVE-2014-4904

The Crossmo Calendar aka com.crossmo.calendar application 1.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Crossmo Calendar aka com.crossmo.calendar application 1.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4904

The Crossmo Calendar aka com.crossmo.calendar application 1.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4904

The CVE-2014-4904 entry concerns the Crossmo Calendar (com.crossmo.calendar) Android app, version 1.7.1, which fails to verify X.509 certificates from SSL servers. This vulnerability allows man‑in‑the‑middle attackers to spoof servers and access sensitive information via a crafted certificate. Th...

Denial of Service vulnerability in extension Calendar Base (cal)

It has been discovered that the extension "Calendar Base" cal is susceptible to Denial of Service. Release Date: October 17, 2014 Bulletin Update: October 18, 2014 added CVE Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: a...

CVE-2014-7138

Cross-site scripting XSS vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gcefeedids parameter in a gceajax action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gcefeedids parameter in a gceajax action to wp-admin/admin-ajax.php...

CVE-2014-7138

Cross-site scripting XSS vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gcefeedids parameter in a gceajax action to wp-admin/admin-ajax.php...

CVE-2014-7138

CVE-2014-7138 affects the Google Calendar Events WordPress plugin. The vulnerability, due to improper sanitization of the gce_feed_ids parameter in the gce_ajax action to wp-admin/admin-ajax.php, enables reflected XSS. An attacker could lure a logged-in administrator to a crafted link and cause a...

Adding Subscription Cal by URL stores user password unencrypted

I discovered that calendar subscriptions not only store user credentials, but do so unencrypted!!! There is really no excuse for this. Subscribe to a calendar by url, then in the DB : code SELECT TOP 1000 ID ,KEY ,SUBCALENDARID ,VALUE FROM YOUR-DB-NAME.dbo.AO950DC3TCSUBCALSPROPS code As an...