9651 matches found
[eVuln] Light Weight Calendar PHP Code Execution
New eVuln Advisory: Light Weight Calendar PHP Code Execution http://evuln.com/vulns/29/summary.html --------------------Summary---------------- Software: Light Weight Calendar Sowtware's Web Site: http://sourceforge.net/projects/lwcal/ Versions: 1.0 Critical Level: Dangerous Type: PHP Code...
Ubuntu 4.10 / 5.04 : evolution vulnerabilities (USN-166-1)
Ulf Harnhammar disovered several format string vulnerabilities in Evolution. By tricking an user into viewing a specially crafted vCard attached to an email, specially crafted contact data from an LDAP server, specially crafted task lists from remote servers, or saving Calendar entries with this...
Sql injection
Eval injection vulnerability in Light Weight Calendar LWC 1.0 20040909 and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php...
CVE-2006-0206
CVE-2006-0206 affects Light Weight Calendar (LWC) 1.0 (20040909) and earlier. The vulnerability is an eval injection: the date parameter submitted to index.php via cal.php is included and can be exploited to execute arbitrary PHP code on the server. This is a remote code execution issue. Connecte...
EUVD-2006-0214
Eval injection vulnerability in Light Weight Calendar LWC 1.0 20040909 and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php...
[SA18450] Light Weight Calendar "date" PHP Code Execution Vulnerability
TITLE: Light Weight Calendar "date" PHP Code Execution Vulnerability SECUNIA ADVISORY ID: SA18450 VERIFY ADVISORY: http://secunia.com/advisories/18450/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Light Weight Calendar 1.x http://secunia.com/product/6810/...
CVE-2006-0182
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...
CVE-2006-0183
The CVE-2006-0183 entry concerns ACal Calendar Project 2.2.5. It describes a direct static code injection vulnerability in edit.php that allows authenticated users to execute arbitrary PHP code by supplying values for edit=header (modifying header.php) or edit=footer (modifying footer.php). This ...
CVE-2006-0182
CVE-2006-0182 affects ACal Calendar Project 2.2.5. The vulnerability in login.php allows remote bypass of authentication by setting the ACalAuthenticate cookie to the literal value “inside,” enabling unauthorized access. Relatedly, CVE-2006-0183 in edit.php permits authenticated users to execute ...
CVE-2006-0183
Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...
CVE-2006-0182
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...
Authentication flaw
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside"...
Code injection
Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...
CVE-2006-0183
Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...
CVE-2006-0167
SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the 1 calid parameter in calendar.php3 and the 2 password field on the login page...
CVE-2005-4642
Multiple cross-site scripting XSS vulnerabilities in HydroBB 1.0.0 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to 1 search.php, 2 members.php, 3 stats.php, 4 viewforum.php, 5 register.php, 6 usercp.php, 7 groups.php, 8 pms.php, and 9 calendar.php...
vbulletin352.txt
Vulnerable Version: 3.5.2 prior versions also may be affected Bug: HtmlInjection Second order CrossSiteScripting Exploitation: Remote with browser HtmlInjection : The software does not properly filter HTML tags in the title of events before being passed to user in 'calendar.php'&'reminder.php AS...
CVE-2006-0080
Cross-site scripting XSS vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by 1 calendar.php and 2 reminder.php...
[KAPDA::#19] - Html Injection in vBulletin 3.5.2
KAPDA New advisory Vendor: http://www.vbulletin.com Vulnerable Version: 3.5.2 prior versions also may be affected Bug: Html Injection Second order cross site scripting Exploitation: Remote with browser Description: -------------------- vBulletin is a powerful, scalable and fully customizable foru...