Buffer overflow

Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by "."...

PYSEC-2016-36

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name...

CVE-2015-8748

CVE-2015-8748 affects Radicale prior to 1.1. It allows remote authenticated users to bypass read/write restrictions (owner_write/owner_only) by using regex metacharacters in the user name (demonstrated with ".*"). The issue originates from regex-based rights handling and can permit privilege esca...

CVE-2015-8747

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name...

CVE-2015-8747

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name...

CVE-2015-8748

Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by "."...

CVE-2016-1505

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore...

CVE-2016-1505

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore...

CVE-2015-8747

Radicale vulnerability CVE-2015-8747 affects the multifilesystem storage backend prior to 1.1, allowing remote attackers to read or write arbitrary files via a crafted component name. The root cause is the multifilesystem backend’s permissive handling of file paths, enabling access beyond intende...

CVE-2016-1505

CVE-2016-1505 affects Radicale’s Windows filesystem storage backend prior to 1.1, allowing a remote attacker to read or write arbitrary files via a crafted path such as /c:/file/ignore. The root cause is a directory-traversal flaw in the storage backend that processes crafted paths, enabling acce...

CVE-2015-8748

Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by "."...

CVE-2016-1505

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore...

CVE-2015-8748

Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by "."...

CVE-2015-8747

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name...

CVE-2015-8748: Undefined Security Weakness

Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by "."...

CVE-2016-1505: Undefined Security Weakness

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore...

CVE-2015-8747: Improper Input Validation

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name...

PT-2016-4848

Name of the Vulnerable Software and Affected Versions Radicale versions prior to 1.1 Description The issue allows remote attackers to read or write to arbitrary files via a crafted path. For example, a crafted path like '/c:/file/ignore' can be used to access files on the system. Recommendations...

Debian DSA-3462-1 : radicale - security update

Two vulnerabilities were fixed in radicale, a CardDAV/CalDAV server. - CVE-2015-8747 The not configured by default and not available on Wheezy multifilesystem storage backend allows read and write access to arbitrary files still subject to the DAC permissions of the user the radicale server is...

FreeBSD : radicale -- multiple vulnerabilities (ff824eea-c69c-11e5-96d6-14dae9d210b8)

Radicale reports : The multifilesystem backend allows access to arbitrary files on all platforms. Prevent regex injection in rights management. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databas...