Webcalendar <= 0.9.42 Cross Site Scripting Attacks and Potential SQL Injection Attack

Webcalendar = 0.9.42 http://webcalendar.sourceforge.net/ WebCalendar is a PHP application used to maintain a calendar for one or more persons Cross Site Scripting ======================================== Files Mabe Others: ---------------------------- includes/js/colors.php Code Sniplet:...

WebCalendar 0.9.x colors.php color XSS

WebCalendar 0.9.x colors.php color XSS. Webapps exploit for php platform source: http://www.securityfocus.com/bid/8539/info It has been reported that WebCalendar is prone to multiple cross-site scripting vulnerabilites in various modules. The issues exist in includes/js/colors.php, week.php,...

WebCalendar 0.9.x week.php user XSS

WebCalendar 0.9.x week.php user XSS. Webapps exploit for php platform source: http://www.securityfocus.com/bid/8539/info It has been reported that WebCalendar is prone to multiple cross-site scripting vulnerabilites in various modules. The issues exist in includes/js/colors.php, week.php, day.php...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

WebCalendar 0.9.x Multiple Modules - SQL Injection source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack ...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack of sufficient sanitization of user-supplied input...

WebCalendar 0.9.x - Local File Inclusion Information Disclosure

WebCalendar 0.9.x - Local File Inclusion Information Disclosure source: https://www.securityfocus.com/bid/8237/info It has been reported that an information disclosure issue exists in WebCalendar. This may allow an attacker to gain unauthorized read access to potentially sensitive information wit...

[Full-Disclosure] WebCalendar Include File

Webcalendar 0.9.41 and below. http://webcalendar.sourceforge.net/ Since this appears to be public info now. Problem: http://sourceforge.net/forum/forum.php?threadid=901234&forumid=11588 Exploit: http://www.some.host/webcalendar/filename.php?userinc=../../../../../etc/passwd - nocon...

WebCalendar long.php user_inc Parameter Traversal Arbitrary File Access

The remote installation of WebCalendar may allow an attacker to read arbitrary files on the remote host by supplying a filename to the 'userinc' argument of the file 'long.php'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

WebCalendar 0.9.x - Local File Inclusion Information Disclosure

source: https://www.securityfocus.com/bid/8237/info It has been reported that an information disclosure issue exists in WebCalendar. This may allow an attacker to gain unauthorized read access to potentially sensitive information with the privileges of the web server process...

CVE-2002-2065

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root...

WebCalendar does not adequately validate user input

Overview WebCalendar does not properly validate user input, allowing attackers to execute arbitrary commands. Description WebCalendar is a free PHP application providing web calendar services for user groups. WebCalendar contains an unspecified input validation vulnerability, allowing arbitrary...

CVE-2001-0477

Vulnerability in WebCalendar 0.9.26 allows remote command execution...

CVE-2001-0477

CVE-2001-0477 affects WebCalendar 0.9.26 and enables remote command execution due to improper input validation in the WebCalendar Web application (PHP). The CERT entry states that arbitrary commands can be executed by a malicious WebCalendar user, with the potential bypass in single-user mode whe...

CVE-2001-0477

Vulnerability in WebCalendar 0.9.26 allows remote command execution...

CVE-2001-0477: Undefined Security Weakness

Vulnerability in WebCalendar 0.9.26 allows remote command execution...

(SRPRE00004) WebCalendar 0.9.26

================================================= Secure Reality Pty Ltd. Security Pre-Advisory 4 SRPRE00004 http://www.securereality.com.au ================================================= Title Remote command execution vulnerabilities in WebCalendar Released 23/4/2001 This is a pre-release. Th...