JVN#04876736: Multiple vulnerabilities in LuxCal Web Calendar

LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2023-39543 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 SQL...

SUSE CVE-2014-9905

Multiple cross-site scripting XSS vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 title of an appointment or 2 contact fields...

SUSE CVE-2016-6191

Multiple cross-site scripting XSS vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 Description, 2 Location, 3 URL, or 4 Title field...

SQLite report about CVE-2023-39543

This is not a bug in SQLite. This is an XSS vulnerability in a separate application LuxCal Web Calendar that links against SQLite. The bug is in the application, not in SQLite. However "SQLite" is mentioned in the description and so we list it here...

SQLite report about CVE-2023-39939

This is not a bug in SQLite. This is an SQL injection bug in an application LuxCal Web Calendar that links against SQLite. Even though this CVE is not about SQLite, "SQLite" is mentioned in the description and so we list it here...

CVE-2021-45915

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

CVE-2021-45914

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

CVE-2021-45915

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

CVE-2021-45914

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

Design/Logic Flaw

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

CVE-2021-45914

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

CVE-2021-45914

LuxSoft LuxCal Web Calendar (prior to 5.2.0) is affected by an unauthenticated POST request manipulation that lets an attacker cause the attacker’s session to be authenticated as any registered LuxCal user, including an administrator. The root cause is improper handling of POST data that permits ...

CVE-2021-45915

In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...

CVE-2021-45915

LuxSoft LuxCal Web Calendar before 5.2.0 is affected. An unauthenticated attacker can manipulate a cookie value to impersonate any registered user, including the administrator. Root cause: cookie-based session fixation/authentication bypass. Affected version: prior to 5.2.0. Remediation: upgrade ...

PT-2022-12465 · Luxsoft · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxSoft LuxCal Web Calendar versions prior to 5.2.0 Description: The issue allows an unauthenticated attacker to manipulate a cookie value, enabling the attacker's session to be authenticated as any registered LuxCal user, including the site...

LuxSoft LuxCal Web Calendar 授权问题漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A security vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.2.0. An attacker can exploit this vulnerability to manipulate cookie values...

LuxSoft LuxCal Web Calendar 授权问题漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A security vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.2.0. An attacker exploited the vulnerability to manipulate POST requests...

Moodle 权限许可和访问控制问题漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. moodle has a permission permission and access control issue vulnerability that stems from insufficient detection of functionality in t...

SOGo < 3.1.3 Multiple XSS Vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the View Raw Source page in the Web Calendar in SOGo allow remote attackers to inject arbitrary web script or HTML via the Description, Location, URL or Title field. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 Description, 2 Location, 3 URL, or 4 Title field...