WebCalendar Login Error Message User Account Enumeration

The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the password is invalid. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[SECURITY] [DSA 1056-1] New webcalendar packages fix information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 1056-1 [email protected] http://www.debian.org/security/ Martin Schulze May 15th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1056-1] New webcalendar packages fix information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 1056-1 [email protected] http://www.debian.org/security/ Martin Schulze May 15th, 2006 http://www.debian.org/security/faq -...

DSA-1056-1 webcalendar - verbose error message

Bulletin has no description...

FreeBSD : WebCalendar -- remote file inclusion vulnerability (60f8fe7b-3cfb-11da-baa2-0004614cc33d)

WebCalendar is proven vulnerable to a remote file inclusion vulnerability. The sendreminders.php does not properly verify the 'includedir' parameter, giving remote attackers the possibility to include local and remote files. These files can be used by the attacker to gain access to the system...

FreeBSD : WebCalendar -- unauthorized access vulnerability (07ead557-a220-11da-b410-000e0c2e438a)

SecurityFocus reports that WebCalendar is affected by an unauthorized access vulnerability. The vulnerability is caused by improper checking of the authentication mechanism before access is being permitted to the 'assistantedit.php' file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Code injection

WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2006-2247

WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2006-2247

WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2006-2247

CVE-2006-2247 affects WebCalendar 1.0.1 through 1.0.3, where login responses differ depending on whether a username exists, enabling remote user enumeration. OpenVAS and Debian advisories describe this as a verbose error/information‑leak vulnerability in a PHP-based multi‑user calendar. The issue...

CVE-2006-2247

WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

[Full-disclosure] WebCalendar User Account Enumeration Weakness

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. See project homepage for details: http://www.k5n.us/webcalendar.php Description: The problem is that different...

Design/Logic Flaw

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to 1 includes/index.php, 2 tests/adddurationtest.php, 3 tests/alltests.php, 4 groups.php, 5 nonusers.php, 6 includes/settings.php, 7 includes/init.php, 8 includes/settings.php.orig, 9...

CVE-2006-1537

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to 1 includes/index.php, 2 tests/adddurationtest.php, 3 tests/alltests.php, 4 groups.php, 5 nonusers.php, 6 includes/settings.php, 7 includes/init.php, 8 includes/settings.php.orig, 9...

CVE-2006-1537

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to 1 includes/index.php, 2 tests/adddurationtest.php, 3 tests/alltests.php, 4 groups.php, 5 nonusers.php, 6 includes/settings.php, 7 includes/init.php, 8 includes/settings.php.orig, 9...

CVE-2006-1537

CVE-2006-1537 affects Craig Knudsen WebCalendar 1.1.0-CVS. The vulnerability allows remote attackers to obtain sensitive information by directly requesting a list of PHP scripts (includes/index.php, tests/add_duration_test.php, tests/all_tests.php, groups.php, nonusers.php, includes/settings.php,...

Full path disclosure in Webcalendar 1.1.0-CVS

Full path disclosure in webcalendar Author : Rusydi Hasan M a.k.a : cR45H3R Location : Indonesia, Cilacap Date : March,28th 2006 Version : 1.1.0-CVS --- software description WebCalendar is a PHP application used to maintain a calendar for one or more persons and for a variety of purposes. ---...

CVE-2006-1372

Multiple SQL injection vulnerabilities in 1WebCalendar 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 EventID parameter in viewEvent.cfm, 2 NewsID parameter in newsView.cfm, or 3 ThisDate parameter in mainCal.cfm...

1WebCalendar v 4.x vuln.

1WebCalendar v 4.x vuln. Vuln. discovered by : r0t Date: 22 march 2006 vendor:www.bensonitsolutions.com/calendar/v4/ affected version: v4.0 and prior orginal advisory: http://pridels.blogspot.com/2006/03/1webcalendar-v-4x-vuln.html Vuln.desc. 1WebCalendar contains a flaw that allows a remote sql...

1WebCalendar 4.0 - mainCal.cfm SQL Injection

1WebCalendar 4.0 - mainCal.cfm SQL Injection source: https://www.securityfocus.com/bid/17193/info 1WebCalendar is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. A...