81 matches found
[SECURITY] [DLA 2034-1] davical security update
Package : davical Version : 1.1.3.1-1+deb8u1 CVE ID : CVE-2019-18345 CVE-2019-18346 CVE-2019-18347 Debian Bug : 946343 Multiple cross-site scripting and cross-site request forgery issues were discovered in the DAViCal CalDAV Server. For Debian 8 "Jessie", these problems have been fixed in version...
DLA-2034-1 davical - security update
Bulletin has no description...
[SECURITY] [DSA 4582-1] davical security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4582-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 13, 2019 https://www.debian.org/security/faq -...
DSA-4582-1 davical - security update
Bulletin has no description...
DEBIAN-CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
Cross site scripting
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
UBUNTU-CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
CVE-2019-18345
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
CVE-2019-18345
The CVE-2019-18345 issue affects the DAViCal CalDAV Server (through 1.1.8) where the action parameter is echoed without encoding, enabling reflected XSS. Impact stated in sources: an attacker visiting a crafted link can view the attacked user’s data and perform actions on behalf of that user; if ...
CVE-2019-18345: Improper Neutralization of Input During Web Page Generation
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...
DAViCal CalDAV Server Cross-Site Scripting Vulnerability
DAViCal is a calendar sharing server that is an implementation of the CalDAV protocol. A cross-site scripting vulnerability exists in DAViCal CalDAV Server version 1.1.8 and earlier. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker can...
DAViCal CalDAV Server 1.1.8 Reflective Cross Site Scripting
Original text at: https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/ At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three severe vulnerabilities. We reported these...
DAViCal CalDAV Server 1.1.8 Persistent Cross Site Scripting
Original text at: https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability/ At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three severe vulnerabilities. We reported these...
PT-2019-5239 · Davical · Davical
Name of the Vulnerable Software and Affected Versions: DAViCal versions through 1.1.8 Description: A reflected XSS issue was discovered in DAViCal. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can vie...
DAViCal CalDAV Server 1.1.8 Cross Site Request Forgery
Original text at: https://hackdefense.com/publications/cve-2019-18346-davical-caldav-server-vulnerability/ At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three severe vulnerabilities. We reported these...
DAViCal Cross-Site Request Forgery Vulnerability
DAViCal is a calendar sharing server that is an implementation of the CalDAV protocol. A cross-site request forgery vulnerability exists in DAViCal 1.1.8 and earlier versions. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted...