PT-2020-7186

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.2.5 Description The issue allows remote attackers to execute arbitrary code via the form single user login parameter in the install/index.php file. Recommendations For versions prior to 1.2.5, update to version...

CVE-2012-1495: Improper Neutralization of Special Elements in Output Used by a Downstream Component

install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the formsingleuserlogin parameter...

CVE-2012-1496: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Local file inclusion in WebCalendar before 1.2.5...

PT-2020-7187

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.2.5 Description The issue concerns a local file inclusion problem. Recommendations For versions prior to 1.2.5, update to version 1.2.5 or later to resolve the issue...

Fedora 27 : WebCalendar (2017-6abd55703b)

New upstream release. Fixes CVE-2017-10840 and CVE-2017-10841. Upstream moved from sourceforge to github. PHP = 5.3 required. Adjust httpd configuration to support PHP FCGI. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 26 : WebCalendar (2017-c9abeb3158)

New upstream release. Fixes CVE-2017-10840 and CVE-2017-10841. Upstream moved from sourceforge to github. PHP = 5.3 required. Adjust httpd configuration to support PHP FCGI. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 25 : WebCalendar (2017-26a53ccbdf)

New upstream release. Fixes CVE-2017-10840 and CVE-2017-10841. Upstream moved from sourceforge to github. PHP = 5.3 required. Adjust httpd configuration to support PHP FCGI. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora Update for WebCalendar FEDORA-2017-26a53ccbdf

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for WebCalendar FEDORA-2017-c9abeb3158

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 26 Update: WebCalendar-1.2.9-1.fc26

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. WebCalendar can be setup in a...

[SECURITY] Fedora 27 Update: WebCalendar-1.2.9-1.fc27

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. WebCalendar can be setup in a...

CVE-2017-10840

Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-10841

Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-10841

Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-10840

Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

Directory traversal

Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-10841: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-10840: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-10840

CVE-2017-10840 affects WebCalendar 1.2.7 and earlier, enabling cross-site scripting (XSS) to inject arbitrary web script or HTML via unspecified vectors. Connected sources corroborate the vulnerability and note that upstream fixed it in a newer release (WebCalendar 1.2.8) and that Fedora updates ...