WebCalendar includes/functions.php noSet Variable Overwrite

The version of WebCalendar installed on the remote host allows an attacker to overwrite the 'noSet' array used by the application to protect selected global variables. By leveraging this issue, an unauthenticated, remote attacker can gain control of protected global variables, which could lead to...

WebCalendar -- "noSet" variable overwrite vulnerability

Secunia reports: A vulnerability has been discovered in WebCalendar, which can be exploited by malicious people to compromise a vulnerable system. Input passed to unspecified parameters is not properly verified before being used with the "noSet" parameter set. This can be exploited to overwrite...

webcal10-xss.txt

WebCalendar =1.0 Cross-Site Scripting Vulnerabilities |=---= WebCalendar =1.0 Cross-Site Scripting Vulnerabilities ---=| |=-----------------------------------------------------------------=| |=---------------= 7all =----------------------=|...

CVE-2006-6669

Cross-site scripting XSS vulnerability in exporthandler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter...

CVE-2006-6669

Cross-site scripting XSS vulnerability in exporthandler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter...

CVE-2006-6669

WebCalendar (v1.0.4 and earlier) is affected by a cross-site scripting (XSS) flaw in export_handler.php that allows an attacker to inject arbitrary script/HTML via the format parameter. The issue has been publicly documented (e.g., CVE-2006-6669; Debian DSA-1279-1) with Debian advising upgrades t...

CVE-2006-6669

Cross-site scripting XSS vulnerability in exporthandler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter...

WebCalendar >=1.0 Cross-Site Scripting Vulnerabilities

WebCalendar =1.0 Cross-Site Scripting Vulnerabilities |=---= WebCalendar =1.0 Cross-Site Scripting Vulnerabilities ---=| |=-----------------------------------------------------------------=| |=---------------= 7all7all7at163.com =----------------------=|...

Debian DSA-1002-1 : webcalendar - several vulnerabilities

Several security related problems have been discovered in webcalendar, a PHP based multi-user calendar. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-3949 Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQ...

Debian DSA-1096-1 : webcalendar - uninitialised variable

A vulnerability has been discovered in webcalendar, a PHP-based multi-user calendar, that allows a remote attacker to execute arbitrary PHP code when registerglobals is turned on. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1056-1 : webcalendar - verbose error message

David Maciejak noticed that webcalendar, a PHP-based multi-user calendar, returns different error messages on login attempts for an invalid password and a non-existing user, allowing remote attackers to gain information about valid usernames. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

FreeBSD : WebCalendar -- information disclosure vulnerability (09c92f3a-fd49-11da-995c-605724cdf281)

Secunia reports : socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information. Input passed to the 'includedir' parameter isn't properly verified, before it is used in an 'fopen' call...

[SECURITY] [DSA 1096-1] New webcalendar packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1096-1 [email protected] http://www.debian.org/security/ Martin Schulze June 13th, 2006 http://www.debian.org/security/faq -...

DSA-1096-1 webcalendar - uninitialised variable

Bulletin has no description...

CVE-2006-2762

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a userinc setting that is used in an...

CVE-2006-2762

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a userinc setting that is used in an...

CVE-2006-2762

CVE-2006-2762: WebCalendar 1.0.3 is vulnerable to a PHP remote file inclusion via the includedir parameter in includes/config.php, leading to arbitrary code execution. The flaw arises because a URL is fed to fopen and its result defines user_inc, which is then used in include_once. Public advisor...

CVE-2006-2762

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a userinc setting that is used in an...

WebCalendar-1.0.3 reading of any files

Version: WebCalendar-1.0.3 Type: Reading of any files Description: ----------------------------- includes/config.php: line 64 if ! empty $includedir $fd = @fopen "$includedir/settings.php", "rb", true ; ...... while ! feof $fd $data .= fgets $fd, 4096 ; $configLines = explode "n", $data ; for $n ...

WebCalendar -- information disclosure vulnerability

Secunia reports: socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information. Input passed to the "includedir" parameter isn't properly verified, before it is used in an "fopen" call...