OverLook Cross-site Scripting Vulnerability

ANATOLIA SECURITY ADVISORY --------------------------- ADVISORY INFO + Title: OverLook Cross-site Scripting + Advisory URL: http://anatoliasecurity.com/Blog/Detay.aspx?bId=2 + Advisory ID: 2010-002 + Version: v5.0 + Date: 06/10/2010 + Impact: Execute Malicious Javascript Codes + CWE-ID: 79 +...

WebCalendar Multiple CSS and CSRF Vulnerabilities

The host is running WebCalendar and is prone to multiple CSS and CSRF Vulnerabilities. OpenVAS Vulnerability Test $Id: gbwebcalendarmultcssncsrfvuln.nasl 5388 2017-02-21 15:13:30Z teissa $ WebCalendar Multiple CSS and CSRF Vulnerabilities Authors: Antu Sanadi Copyright: Copyright c 2010 Greenbone...

WebCalendar < 1.2.1 Multiple XSS and CSRF Vulnerabilities

WebCalendar is prone to multiple cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0638

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0638

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0638

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0638

CVE-2010-0638 affects WebCalendar 1.2.0, where a CSRF flaw allows remote attackers to hijack administrator sessions and perform password changes. The exact exploitation vectors are not detailed in the provided documents. OpenVAS notes multiple CSRF (and XSS) vulnerabilities in WebCalendar and ind...

CVE-2010-0638: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0636

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the 1 tab parameter to users.php and the PATHINFO to 2 day.php, 3 month.php, and 4 week.php. NOTE: some of these details are...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that 1 delete an event or 2 ban an IP address from posting via unknown vectors. NOTE: some of these...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the 1 tab parameter to users.php and the PATHINFO to 2 day.php, 3 month.php, and 4 week.php. NOTE: some of these details are...

CVE-2010-0637

Multiple cross-site request forgery CSRF vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that 1 delete an event or 2 ban an IP address from posting via unknown vectors. NOTE: some of these...

CVE-2010-0637

Multiple cross-site request forgery CSRF vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that 1 delete an event or 2 ban an IP address from posting via unknown vectors. NOTE: some of these...

CVE-2010-0636

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the 1 tab parameter to users.php and the PATHINFO to 2 day.php, 3 month.php, and 4 week.php. NOTE: some of these details are...

CVE-2010-0636

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the 1 tab parameter to users.php and the PATHINFO to 2 day.php, 3 month.php, and 4 week.php. NOTE: some of these details are...

CVE-2010-0637

Multiple cross-site request forgery CSRF vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that 1 delete an event or 2 ban an IP address from posting via unknown vectors. NOTE: some of these...

CVE-2010-0636

WebCalendar 1.2.0 and all versions before 1.2.5 are vulnerable to multiple XSS flaws. An attacker can inject arbitrary script via the tab parameter to users.php and via PATH_INFO to day.php, month.php, and week.php. The issue stems from insufficient input sanitization. Upgrading to 1.2.5 or later...

CVE-2010-0637

WebCalendar 1.2.0 and earlier (up to 1.2.5) are vulnerable to multiple CSRF flaws that can hijack administrator sessions to perform actions such as deleting events or banning IPs. The issue affects the product as described in CVE-2010-0637 with a CVSS base score of 6.8 (network, medium complexity...

CVE-2010-0637: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that 1 delete an event or 2 ban an IP address from posting via unknown vectors. NOTE: some of these...