[ISecAuditors Security Advisories] PHP-Calendar <= v1.1 'configfile' Remote and Local File Inclusion vulnerability

============================================= INTERNET SECURITY AUDITORS ALERT 2009-011 - Original release date: October 13th, 2009 - Last revised: December 18th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3702 - Severity: 8.5/10 CVSS Base Score...

PHP-Calendar 1.1 - update10.php?configfile Traversal Local File Inclusion

PHP-Calendar 1.1 - update10.php?configfile Traversal Local File Inclusion source: https://www.securityfocus.com/bid/37450/info PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may...

PHP-Calendar 1.1 - 'update10.php?configfile' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/37450/info PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the...

PHP-Calendar 1.1 - 'update08.php?configfile' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/37450/info PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the...

PHP-Calendar 1.1 Remote/Local File Inclusion

============================================= INTERNET SECURITY AUDITORS ALERT 2009-011 - Original release date: October 13th, 2009 - Last revised: December 18th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3702 - Severity: 8.5/10 CVSS Base Score...

Sql injection

SQL injection vulnerability in the Diocese of Portsmouth Calendar pdcalendar extension 0.4.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2008-6691...

CVE-2009-4336

Cross-site scripting XSS vulnerability in the Diocese of Portsmouth Calendar pdcalendar extension 0.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4336

Cross-site scripting XSS vulnerability in the Diocese of Portsmouth Calendar pdcalendar extension 0.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4337

CVE-2009-4337 describes a SQL injection in the TYPO3 Diocese of Portsmouth Calendar (pd_calendar) extension version 0.4.1 and earlier. The vulnerability allows remote attackers to execute arbitrary SQL commands via unknown vectors, with impact described as partial confidentiality, integrity, and ...

CVE-2009-4336

CVE-2009-4336 concerns the Diocese of Portsmouth Calendar (pd_calendar) extension for TYPO3 (versions 0.4.1 and earlier). The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected software is TYPO3-...

Sun Java Calendar Deserialization Privilege Escalation

This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM. The payload can be either a native payload which is generated as an executable and dropped/executed on the target or a shell from within the Java applet in the target browser. The affected Java versions are JDK...

Sunbird 0.9 Array Overrun

Sunbird 0.9 Array Overrun code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - Dis.: 07.05.2009 - Pub.: 11.12.2009 CVE: CVE-2009-0689 CWE: CWE-199 Risk: High Remote: Yes Affected Software: - Sunbird 0.9 NOTE: Prior versions may also be affected. Original URL:...

Sunbird 0.9 - Array Overrun Code Execution

Sunbird 0.9 - Array Overrun Code Execution full disclosure: http://seclists.org/fulldisclosure/2009/Dec/253 Sunbird 0.9 Array Overrun code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - Dis.: 07.05.2009 - Pub.: 11.12.2009 CVE: CVE-2009-0689 CWE: CWE-199 Risk:...

Sunbird 0.9 - Array Overrun Code Execution

full disclosure: http://seclists.org/fulldisclosure/2009/Dec/253 Sunbird 0.9 Array Overrun code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - Dis.: 07.05.2009 - Pub.: 11.12.2009 CVE: CVE-2009-0689 CWE: CWE-199 Risk: High Remote: Yes Affected Software: -...

CVE-2009-4158

SQL injection vulnerability in the Calendar Base cal extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the Calendar Base cal extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4158

CVE-2009-4158 : A SQL injection vulnerability exists in the TYPO3 Calendar Base (cal) extension before 1.2.1, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affects the TYPO3 Calendar Base extension up to version 1.2.0. Root cause is improper handling of user...

CVE-2009-4158

SQL injection vulnerability in the Calendar Base cal extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Blind SQL Injection vulnerability in extension Calendar Base (cal)

It has been discovered that the extension Calendar Base cal is vulnerable to Blind SQL Injection. Release Date: December 1, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.2.0 and all versions below...

CVE-2009-4099

SQL injection vulnerability in the Google Calendar GCalendar comgcalendar component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter. NOTE: some of these details are obtained from third party information...