CVE-2006-0206

CVE-2006-0206 affects Light Weight Calendar (LWC) 1.0 (20040909) and earlier. The vulnerability is an eval injection: the date parameter submitted to index.php via cal.php is included and can be exploited to execute arbitrary PHP code on the server. This is a remote code execution issue. Connecte...

EUVD-2006-0214

Eval injection vulnerability in Light Weight Calendar LWC 1.0 20040909 and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php...

[SA18450] Light Weight Calendar "date" PHP Code Execution Vulnerability

TITLE: Light Weight Calendar "date" PHP Code Execution Vulnerability SECUNIA ADVISORY ID: SA18450 VERIFY ADVISORY: http://secunia.com/advisories/18450/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Light Weight Calendar 1.x http://secunia.com/product/6810/...

CVE-2006-0182

login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...

CVE-2006-0183

Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...

CVE-2006-0182

CVE-2006-0182 affects ACal Calendar Project 2.2.5. The vulnerability in login.php allows remote bypass of authentication by setting the ACalAuthenticate cookie to the literal value “inside,” enabling unauthorized access. Relatedly, CVE-2006-0183 in edit.php permits authenticated users to execute ...

CVE-2006-0183

The CVE-2006-0183 entry concerns ACal Calendar Project 2.2.5. It describes a direct static code injection vulnerability in edit.php that allows authenticated users to execute arbitrary PHP code by supplying values for edit=header (modifying header.php) or edit=footer (modifying footer.php). This ...

Code injection

Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...

CVE-2006-0182

login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...

Authentication flaw

login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...

CVE-2006-0183

Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...

CVE-2006-0167

SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the 1 calid parameter in calendar.php3 and the 2 password field on the login page...

CVE-2005-4642

Multiple cross-site scripting XSS vulnerabilities in HydroBB 1.0.0 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to 1 search.php, 2 members.php, 3 stats.php, 4 viewforum.php, 5 register.php, 6 usercp.php, 7 groups.php, 8 pms.php, and 9 calendar.php...

vbulletin352.txt

Vulnerable Version: 3.5.2 prior versions also may be affected Bug: HtmlInjection Second order CrossSiteScripting Exploitation: Remote with browser HtmlInjection : The software does not properly filter HTML tags in the title of events before being passed to user in 'calendar.php'&'reminder.php AS...

CVE-2006-0080

Cross-site scripting XSS vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by 1 calendar.php and 2 reminder.php...

[KAPDA::#19] - Html Injection in vBulletin 3.5.2

KAPDA New advisory Vendor: http://www.vbulletin.com Vulnerable Version: 3.5.2 prior versions also may be affected Bug: Html Injection Second order cross site scripting Exploitation: Remote with browser Description: -------------------- vBulletin is a powerful, scalable and fully customizable foru...

CVE-2005-4657

Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2005-2461

Multiple SQL injection vulnerabilities in the calendar feature in Kayako liveResponse 2.x allow remote attackers to execute arbitrary SQL commands via the 1 year or 2 date parameter...

Jax Calendar 1.34 - jax_calendar.php SQL Injection

Jax Calendar 1.34 - jaxcalendar.php SQL Injection source: https://www.securityfocus.com/bid/16130/info Jax Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

Jax Calendar 1.34 - 'jax_calendar.php' SQL Injection

source: https://www.securityfocus.com/bid/16130/info Jax Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...