441 matches found
CVE-2005-0474
SQL injection vulnerability in the uservalidcrypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendarsession cookie...
CVE-2005-0474
CVE-2005-0474 is a SQL injection vulnerability in WebCalendar 0.9.45. The issue affects the user_valid_crypt function in user.php, allowing remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie. Multiple sources (NVD/NVDCV, CVE lists, and Nessus/NASL feeds) ...
CVE-2004-1507
CVE-2004-1507 describes a CRLF injection flaw in WebCalendar’s login.php that allows remote attackers to inject CRLF sequences via the return_path parameter, enabling HTTP Response Splitting to alter server HTML content. The NVD entry lists a network attack vector with no authentication, low comp...
CVE-2004-1509
CVE-2004-1509 affects WebCalendar via validate.php, where a remote attacker can gain sensitive information by supplying an invalid encoded_login parameter, causing the full path to be exposed in an error message. The NVD entry lists a CVSS v2 base score of 5.0 (Medium) with network access, no aut...
CVE-2004-1506
Multiple cross-site scripting XSS vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via 1 viewentry.php, 2 viewd.php, 3 usersel.php, 4 datesel.php, 5 trailer.php, or 6 styles.php, as demonstrated using img srg tags...
CVE-2004-1507
CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the returnpath parameter and perform HTTP Response Splitting attacks to modify expected HTML content from the server...
CVE-2004-1510
WebCalendar allows remote attackers to gain privileges by modifying critical parameters to 1 viewentry.php or 2 upcoming.php...
CVE-2004-1510
WebCalendar (the product) is documented as vulnerable to a remote SQL Injection that can be triggered by modifying parameters in view_entry.php or upcoming.php, potentially enabling privilege escalation. OpenVAS entries describe the vulnerability as allowing the attacker to cause the program to e...
CVE-2005-0474
SQL injection vulnerability in the uservalidcrypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendarsession cookie...
CVE-2004-1508
init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the userinc parameter...
CVE-2004-1509
validate.php in WebCalendar allows remote attackers to gain sensitive information via an invalid encodedlogin parameter, which reveals the full path in an error message...
CVE-2004-1508
CVE-2004-1508 : The WebCalendar project is affected through init.php, where remote attackers can cause the application to execute arbitrary local PHP scripts via the user_inc parameter. This corresponds to a network-accessible vulnerability with a CVSS v2 base score of 7.5 (high). OpenVAS entries...
CVE-2004-1506
CVE-2004-1506 : WebCalendar has multiple XSS vulnerabilities allowing remote attackers to inject arbitrary script via (1) view_entry.php, (2) view_d.php, (3) usersel.php, (4) datesel.php, (5) trailer.php, or (6) styles.php, as described (including examples using img tags). The provided documents ...
WebCalendar users.php user_valid_crypt Parameter < 1.0.0 SQL Injection
Binary data 2628.prm...
[ SCL-2005.001 ] - WebCalendar: SQL Injection from encoded cookie
=====BEGIN-SCL-REPORT===== Scovetta Labs Security Advisory Title: WebCalendar: SQL Injection from encoded cookie Status: Public Release Date: 2005-02-16 Package: WebCalendar Vendor: k5n.us - http://www.k5n.us/webcalendar.php Priority: High Vulnerability: SQL Injection Affected Versions:...
WebCalendar login.php webcalendar_session Cookie SQL Injection
The remote version of WebCalendar contains a SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements against the remote database. An attacker may be able to leverage this issue to, for example, delete arbitrary database tables. %NASLMINLEVEL 70300 C Tenable...
WebCalendar 0.9.45 - SQL Injection
WebCalendar 0.9.45 - SQL Injection source: https://www.securityfocus.com/bid/12581/info WebCalendar is affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could...
WebCalendar 0.9.45 - SQL Injection
source: https://www.securityfocus.com/bid/12581/info WebCalendar is affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the...
CVE-2004-1506
Multiple cross-site scripting XSS vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via 1 viewentry.php, 2 viewd.php, 3 usersel.php, 4 datesel.php, 5 trailer.php, or 6 styles.php, as demonstrated using img srg tags...