CVE-2006-6669

Cross-site scripting XSS vulnerability in exporthandler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter...

CVE-2006-6669

Cross-site scripting XSS vulnerability in exporthandler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter...

CVE-2006-6669

Cross-site scripting XSS vulnerability in exporthandler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter...

CVE-2006-6669

WebCalendar (v1.0.4 and earlier) is affected by a cross-site scripting (XSS) flaw in export_handler.php that allows an attacker to inject arbitrary script/HTML via the format parameter. The issue has been publicly documented (e.g., CVE-2006-6669; Debian DSA-1279-1) with Debian advising upgrades t...

CVE-2006-6669: Undefined Security Weakness

Cross-site scripting XSS vulnerability in exporthandler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter...

WebCalendar >=1.0 Cross-Site Scripting Vulnerabilities

WebCalendar =1.0 Cross-Site Scripting Vulnerabilities |=---= WebCalendar =1.0 Cross-Site Scripting Vulnerabilities ---=| |=-----------------------------------------------------------------=| |=---------------= 7all7all7at163.com =----------------------=|...

Debian DSA-1056-1 : webcalendar - verbose error message

David Maciejak noticed that webcalendar, a PHP-based multi-user calendar, returns different error messages on login attempts for an invalid password and a non-existing user, allowing remote attackers to gain information about valid usernames. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Debian DSA-1002-1 : webcalendar - several vulnerabilities

Several security related problems have been discovered in webcalendar, a PHP based multi-user calendar. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-3949 Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQ...

Debian DSA-1096-1 : webcalendar - uninitialised variable

A vulnerability has been discovered in webcalendar, a PHP-based multi-user calendar, that allows a remote attacker to execute arbitrary PHP code when registerglobals is turned on. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : WebCalendar -- information disclosure vulnerability (09c92f3a-fd49-11da-995c-605724cdf281)

Secunia reports : socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information. Input passed to the 'includedir' parameter isn't properly verified, before it is used in an 'fopen' call...

[SECURITY] [DSA 1096-1] New webcalendar packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1096-1 [email protected] http://www.debian.org/security/ Martin Schulze June 13th, 2006 http://www.debian.org/security/faq -...

DSA-1096-1 webcalendar - uninitialised variable

Bulletin has no description...

CVE-2006-2762

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a userinc setting that is used in an...

CVE-2006-2762

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a userinc setting that is used in an...

CVE-2006-2762

CVE-2006-2762: WebCalendar 1.0.3 is vulnerable to a PHP remote file inclusion via the includedir parameter in includes/config.php, leading to arbitrary code execution. The flaw arises because a URL is fed to fopen and its result defines user_inc, which is then used in include_once. Public advisor...

CVE-2006-2762

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a userinc setting that is used in an...

CVE-2006-2762: Undefined Security Weakness

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a userinc setting that is used in an...

WebCalendar-1.0.3 reading of any files

Version: WebCalendar-1.0.3 Type: Reading of any files Description: ----------------------------- includes/config.php: line 64 if ! empty $includedir $fd = @fopen "$includedir/settings.php", "rb", true ; ...... while ! feof $fd $data .= fgets $fd, 4096 ; $configLines = explode "n", $data ; for $n ...

WebCalendar -- information disclosure vulnerability

Secunia reports: socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information. Input passed to the "includedir" parameter isn't properly verified, before it is used in an "fopen" call...

WebCalendar Login Error Message User Account Enumeration

The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the password is invalid. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...