CVE-2004-1507

CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the returnpath parameter and perform HTTP Response Splitting attacks to modify expected HTML content from the server...

CVE-2004-1509

validate.php in WebCalendar allows remote attackers to gain sensitive information via an invalid encodedlogin parameter, which reveals the full path in an error message...

CVE-2004-1508

init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the userinc parameter...

webcalendar.txt

--------------------------------------------------------------------------- Multiple Vulnerabilities in WebCalendar --------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2004 Location: Basque Country...

Multiple Vulnerabilities in WebCalendar

--------------------------------------------------------------------------- Multiple Vulnerabilities in WebCalendar --------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2004 Location: Basque Country...

webcalendar 0.9.x - Multiple Vulnerabilities

webcalendar 0.9.x - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/11651/info Multiple remote vulnerabilities are reported to exist in WebCalendar. Multiple cross-site scripting vulnerabilites, an HTTP response splitting vulnerability, and two authentication bypass...

Webcalendar <= 0.9.42 Cross Site Scripting Attacks and Potential SQL Injection Attack

Webcalendar = 0.9.42 http://webcalendar.sourceforge.net/ WebCalendar is a PHP application used to maintain a calendar for one or more persons Cross Site Scripting ======================================== Files Mabe Others: ---------------------------- includes/js/colors.php Code Sniplet:...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

WebCalendar 0.9.x Multiple Modules - SQL Injection source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack ...

WebCalendar 0.9.x colors.php color XSS

WebCalendar 0.9.x colors.php color XSS. Webapps exploit for php platform source: http://www.securityfocus.com/bid/8539/info It has been reported that WebCalendar is prone to multiple cross-site scripting vulnerabilites in various modules. The issues exist in includes/js/colors.php, week.php,...

WebCalendar 0.9.x week.php user XSS

WebCalendar 0.9.x week.php user XSS. Webapps exploit for php platform source: http://www.securityfocus.com/bid/8539/info It has been reported that WebCalendar is prone to multiple cross-site scripting vulnerabilites in various modules. The issues exist in includes/js/colors.php, week.php, day.php...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack of sufficient sanitization of user-supplied input...

WebCalendar 0.9.x - Local File Inclusion Information Disclosure

WebCalendar 0.9.x - Local File Inclusion Information Disclosure source: https://www.securityfocus.com/bid/8237/info It has been reported that an information disclosure issue exists in WebCalendar. This may allow an attacker to gain unauthorized read access to potentially sensitive information wit...

[Full-Disclosure] WebCalendar Include File

Webcalendar 0.9.41 and below. http://webcalendar.sourceforge.net/ Since this appears to be public info now. Problem: http://sourceforge.net/forum/forum.php?threadid=901234&forumid=11588 Exploit: http://www.some.host/webcalendar/filename.php?userinc=../../../../../etc/passwd - nocon...

WebCalendar long.php user_inc Parameter Traversal Arbitrary File Access

The remote installation of WebCalendar may allow an attacker to read arbitrary files on the remote host by supplying a filename to the 'userinc' argument of the file 'long.php'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

WebCalendar 0.9.x - Local File Inclusion Information Disclosure

source: https://www.securityfocus.com/bid/8237/info It has been reported that an information disclosure issue exists in WebCalendar. This may allow an attacker to gain unauthorized read access to potentially sensitive information with the privileges of the web server process...

CVE-2002-2065

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root...

WebCalendar does not adequately validate user input

Overview WebCalendar does not properly validate user input, allowing attackers to execute arbitrary commands. Description WebCalendar is a free PHP application providing web calendar services for user groups. WebCalendar contains an unspecified input validation vulnerability, allowing arbitrary...

CVE-2001-0477

Vulnerability in WebCalendar 0.9.26 allows remote command execution...

CVE-2001-0477

Vulnerability in WebCalendar 0.9.26 allows remote command execution...

CVE-2001-0477

CVE-2001-0477 affects WebCalendar 0.9.26 and enables remote command execution due to improper input validation in the WebCalendar Web application (PHP). The CERT entry states that arbitrary commands can be executed by a malicious WebCalendar user, with the potential bypass in single-user mode whe...