[Full-disclosure] PHP: Calendar Buffer Overflow

There are some nice sprintf's in "extcalendarcalendar.c": 'sprintfdate, "i/i/i", month, day, year;' Example exploitation 4.3.11: ?php JDToGregorian999999999; ? Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia -...

PHP calendar functions buffer overflow

Buffer overflow in calendar functions, e.g. JDToGregorian on large integer...

CVE-2005-1756

Cross-site scripting XSS vulnerability in the ModWeb agent for Novell NetMail 3.52 before 3.52C allows remote attackers to inject arbitrary web script or HTML via calendar display fields...

Immunity Canvas: IPSWITCH_CAL

Name| ipswitchcal ---|--- CVE| CVE-2005-1252 Exploit Pack| CANVAS Description| Ipswitch Calendar Directory Traversal Notes| CVE Name: CVE-2005-1252 VENDOR: IPSwitch Reference: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=242 VersionsAffected: IMail 8.13 up to 8.2p1...

CVE-2005-1481

Multiple SQL injection vulnerabilities in Aaron Outpost ASP Inline Corporate Calendar allow remote attackers to execute arbitrary SQL commands via the EventID parameter to 1 defer.asp or 2 details.asp...

CVE-2005-1481

The CVE-2005-1481 entry maps to multiple SQL injection flaws in Aaron Outpost’s ASP Inline Corporate Calendar. OpenVAS details describe both defer.asp and details.asp as vulnerable endpoints taking an Event_ID parameter, enabling remote attackers to inject SQL commands. The underlying issue is im...

CVE-2003-1185

Multiple SQL injection vulnerabilities in ThWboard before Beta 2.8.2 allow remote attackers to inject arbitrary SQL commands via various vectors including 1 Admin-Center, 2 Announcements, 3 admin/calendar.php, and 4 showevent.php...

[HSC Security Group] ASP Inline Corporate Calendar SQL injection

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: SQL injection : ASP Inline Corporate Calendar Risk: Medium The Corporate Calendar is a nice asp script to manage a calendar shared by users. It has been downloaded by thousands people, and it is considered...

[SA15239] ASP Inline Corporate Calendar "Event_ID" SQL Injection

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: ASP Inline Corporate Calendar "EventID" SQL Injection...

ASP Inline Corporate Calendar 3.6.3 - 'Defer.asp' SQL Injection

source: https://www.securityfocus.com/bid/13485/info ASP Inline Corporate Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a...

ASP Inline Corporate Calendar 3.6.3 - 'Details.asp' SQL Injection

source: https://www.securityfocus.com/bid/13487/info ASP Inline Corporate Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a...

CVE-2005-1397

SQL injection vulnerability in search.php for PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2005-1116

Cross-site scripting XSS vulnerability in the Calendar module for phpBB allow remote attackers to inject arbitrary web script or HTML via the start parameter to calendarscheduler.php...

CVE-2005-0871

calendarscheduler.php in Topic Calendar 1.0.1 module for phpBB, when running on a Microsoft IIS server, allows remote attackers to obtain sensitive information via invalid parameters, which reveal the path in an error message...

CVE-2005-1397

SQL injection vulnerability in search.php for PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2005-1397

PHP-Calendar is affected by a SQL injection in includes/search.php prior to version 0.10.3. The vulnerability allows remote attackers to manipulate SQL queries via unsanitized input in search-related parameters (vectors not explicitly disclosed). Impact per sources: potential exposure of data and...

CVE-2005-1223

Multiple SQL injection vulnerabilities in Ocean12 Calendar manager 1.01 allow remote attackers to execute arbitrary SQL commands via the Adminid field...

PHP-Calendar includes/search.php Multiple Parameter SQL Injection

The remote web server is running PHP-Calendar, a web-based calendar written in PHP. The version of PHP-Calendar installed on the remote host suffers from a SQL injection vulnerability due to its failure to sanitize input to the 'sort' and 'order' parameters to the 'includes/search.php' script. An...

PHP-Calendar < 0.10.3 includes/search.php SQL Injection

Binary data 2864.prm...

CVE-2005-1223

CVE-2005-1223 describes multiple SQL injection vulnerabilities in Ocean12 Calendar Manager 1.01 allowing remote attackers to execute arbitrary SQL commands via the Admin_id field. The NVD entry rates this with a base score of 7.5 (HIGH) under CVSSv2, with network attack vector and low complexity,...