CVE-2005-2320: Undefined Security Weakness

WebCalendar before 1.0.0 does not properly restrict access to assistantedit.php, which allows remote attackers to gain privileges...

CVE-2002-2065

WebCalendar 0.9.34 and earlier is affected by an insecure include-file access vulnerability. When the product is built with “browsing in includes directory” enabled, remote attackers can read arbitrary .inc files from the web root. Root cause: insecure include-path handling allows reading local i...

CVE-2002-2065

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root...

CVE-2002-2065: Undefined Security Weakness

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root...

WebCalendar assistant_edit.php Unauthorized Access

The remote version of WebCalendar fails to restrict access to the script 'assistantedit.php'. An attacker can use this script to change assistants and to display all users in the system even when the 'Public access can view other users' setting has been disabled. %NASLMINLEVEL 70300 C Tenable...

[SA15788] WebCalendar "assistant_edit.php" Security Bypass

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

WebCalendar -- unauthorized access vulnerability

SecurityFocus reports that WebCalendar is affected by an unauthorized access vulnerability. The vulnerability is caused by improper checking of the authentication mechanism before access is being permitted to the "assistantedit.php" file...

CVE-2005-0474

SQL injection vulnerability in the uservalidcrypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendarsession cookie...

CVE-2005-0474

SQL injection vulnerability in the uservalidcrypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendarsession cookie...

CVE-2005-0474

CVE-2005-0474 is a SQL injection vulnerability in WebCalendar 0.9.45. The issue affects the user_valid_crypt function in user.php, allowing remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie. Multiple sources (NVD/NVDCV, CVE lists, and Nessus/NASL feeds) ...

CVE-2004-1506

CVE-2004-1506 : WebCalendar has multiple XSS vulnerabilities allowing remote attackers to inject arbitrary script via (1) view_entry.php, (2) view_d.php, (3) usersel.php, (4) datesel.php, (5) trailer.php, or (6) styles.php, as described (including examples using img tags). The provided documents ...

CVE-2004-1508

CVE-2004-1508 : The WebCalendar project is affected through init.php, where remote attackers can cause the application to execute arbitrary local PHP scripts via the user_inc parameter. This corresponds to a network-accessible vulnerability with a CVSS v2 base score of 7.5 (high). OpenVAS entries...

CVE-2004-1510

WebCalendar (the product) is documented as vulnerable to a remote SQL Injection that can be triggered by modifying parameters in view_entry.php or upcoming.php, potentially enabling privilege escalation. OpenVAS entries describe the vulnerability as allowing the attacker to cause the program to e...

CVE-2005-0474

SQL injection vulnerability in the uservalidcrypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendarsession cookie...

CVE-2004-1506

Multiple cross-site scripting XSS vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via 1 viewentry.php, 2 viewd.php, 3 usersel.php, 4 datesel.php, 5 trailer.php, or 6 styles.php, as demonstrated using img srg tags...

CVE-2004-1508

init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the userinc parameter...

CVE-2004-1509

validate.php in WebCalendar allows remote attackers to gain sensitive information via an invalid encodedlogin parameter, which reveals the full path in an error message...

CVE-2004-1510

WebCalendar allows remote attackers to gain privileges by modifying critical parameters to 1 viewentry.php or 2 upcoming.php...

CVE-2004-1507

CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the returnpath parameter and perform HTTP Response Splitting attacks to modify expected HTML content from the server...

CVE-2004-1507

CVE-2004-1507 describes a CRLF injection flaw in WebCalendar’s login.php that allows remote attackers to inject CRLF sequences via the return_path parameter, enabling HTTP Response Splitting to alter server HTML content. The NVD entry lists a network attack vector with no authentication, low comp...