Jax Calendar 1.34 - 'jax_calendar.php' SQL Injection

source: https://www.securityfocus.com/bid/16130/info Jax Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

Plexcor's(r) CMS XSS vuln.

Plexcor's® CMS XSS vuln. Vuln. discovered by : r0t Date: 21 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/plexcors-cms-xss-vuln.html vendor:http://www.plexcor.com/ affected version: 4.0 and prior Product Description: Integrated modular content, communications, calendar, commerce,...

CVE-2005-4327

Multiple cross-site scripting XSS vulnerabilities in Michael Arndt WebCal 1.11-3.04 allow remote attackers to inject arbitrary web script or HTML via the 1 function, 2 year, and 3 date parameters to webcal.cgi, 4 new calendar entries, and 5 notes for entries...

perl-cal-29920.txt

------=Part1714122617522.1134045408185 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Vendor: Perl-Cal Version tested: Perl-Cal 2.99.20 , other versions may also be affected. Type: Cross Site Scripting Severity: Medium...

SEC-20051211-0.txt

SEC Consult Security Advisory ========================================================================== title: program: vulnerable version: homepage: found: by: / SEC Consult / www.sec-consult.com ========================================================================== ------------------- vend...

CVE-2005-4189

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Calendar name field when creating calendars, 2 event title field when deleting events, the 3 Category and 4 Location search fields...

CVE-2005-4199

Multiple SQL injection vulnerabilities in MyBulletinBoard MyBB before 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 month, 2 day, and 3 year parameters in an addevent action in calendar.php; 4 threadmode and 5 showcodebuttons in an options action in usercp.php; 6 list...

CVE-2005-4189

CVE-2005-4189 covers multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 prior to 2.0.6. The issue arises from insufficient input sanitisation in several user-controllable fields (Calendar name when creating calendars; event title when deleting events; Category and Location ...

CVE-2005-4189

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Calendar name field when creating calendars, 2 event title field when deleting events, the 3 Category and 4 Location search fields...

SEC Consult SA-20051211-0 :: Several XSS issues in Horde Framework, Kronolith Calendar, Mnemo Notes, Nag Tasks and Turba Addressbook

SEC Consult Security Advisory 20051211-0 ========================================================================== title: Several XSS issues in Horde Framework, Kronolith Calendar, Mnemo Notes, Nag Tasks and Turba Addressbook program: Horde Application Framework + Modules vulnerable version:...

CVE-2005-4139

Multiple SQL injection vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to execute arbitrary SQL commands via the 1 year parameter in calendar.php, 2 user parameter array in vprofile.php, and 3 the userid parameter in misc.php...

CVE-2005-4008

SQL injection vulnerability in jaxcalendar.php in Jax Calendar 1.34 allows remote attackers to execute arbitrary SQL commands via the 1 calid parameter, and possibly the 2 Y and 3 m parameters...

CVE-2005-4009

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cid and 2 catid parameters to a day.php, b week.php, c month.php, and d year.php...

CVE-2005-4008

CVE-2005-4008 affects Jax Calendar 1.34. A SQL injection flaw exists in jax_calendar.php, exploitable via the cal_id parameter and possibly Y and m parameters, allowing remote attackers to alter/steal data. The NVD reports a CVSSv2 base score of 7.5 ( HIGH ) with network access, low attack comple...

CVE-2005-4009

Summary of confirmed issues (CVE-2005-4009, CVE-2007-3627, related CVEs): PHP Lite Calendar Express 2.2 and earlier contain multiple SQL injection vulnerabilities. The CVE-2005-4009 entries describe injection via the cid and catid parameters to day.php, week.php, month.php, and year.php. The CVE-...

CVE-2005-4009

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cid and 2 catid parameters to a day.php, b week.php, c month.php, and d year.php...

CVE-2005-4008

SQL injection vulnerability in jaxcalendar.php in Jax Calendar 1.34 allows remote attackers to execute arbitrary SQL commands via the 1 calid parameter, and possibly the 2 Y and 3 m parameters...

CVE-2005-4011

The CVE-2005-4011 vulnerability affects Codewalkers ltwCalendar (aka PHP Event Calendar) and involves a SQL injection in calendar.php via the id parameter. Affected versions are 4.2, 4.1.3 and earlier. The underlying issue is improper input handling that allows remote attackers to execute arbitra...

CVE-2005-3933

SQL injection vulnerability in index.php in 88Script's Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter...

CVE-2005-3933

CVE-2005-3933 affects 88Script’s Event Calendar 2.0 and earlier. It is an SQL injection in index.php exploitable via the m parameter , enabling remote attackers to execute arbitrary SQL commands. Impact is noted as partial on confidentiality, integrity, and availability. The provided documents do...