496 matches found
Cross-Site Request Forgery (CSRF) in craigk5n/webcalendar
Description Cross-Site Request Forgery CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering such as sending a link via email or chat, an attacker may trick the users of a web...
Cross-site Scripting (XSS) - Reflected in craigk5n/webcalendar
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execut...
Cross-site Scripting (XSS) - Stored in craigk5n/webcalendar
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execut...
CVE-2013-1422
webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...
CVE-2013-1422
webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...
Design/Logic Flaw
webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...
CVE-2013-1422
webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...
CVE-2013-1422
webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...
CVE-2013-1422
CVE-2013-1422 affects webCalendar (WebCalendar) prior to version 1.2.7. The flaw is that failed-login responses leak the reason (e.g., “no such user”), enabling user enumeration by an attacker via authentication attempts. The vulnerability is tied to the login error messaging rather than a fully ...
CVE-2013-1422: Observable Discrepancy
webcalendar before 1.2.7 shows the reason for a failed login e.g., "no such user"...
PT-2020-7350
Name of the Vulnerable Software and Affected Versions: webcalendar versions prior to 1.2.7 Description: The issue allows an attacker to gather information about the validity of user accounts, as the system reveals the reason for a failed login, such as "no such user". Recommendations: For version...
CVE-2012-1496
Local file inclusion in WebCalendar before 1.2.5...
CVE-2012-1495
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the formsingleuserlogin parameter...
Code injection
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the formsingleuserlogin parameter...
Remote file inclusion
Local file inclusion in WebCalendar before 1.2.5...
CVE-2012-1495
WebCalendar is affected by CVE-2012-1495: install/index.php in WebCalendar versions before 1.2.5 allows remote code execution via the form_single_user_login parameter (pre-auth). The vulnerability enables arbitrary code execution with web user privileges and has multiple public references detaili...
CVE-2012-1495
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the formsingleuserlogin parameter...
CVE-2012-1495
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the formsingleuserlogin parameter...
CVE-2012-1496
CVE-2012-1496 affects WebCalendar prior to 1.2.5. Multiple sources document local file inclusion (LFI) in WebCalendar, with OpenVAS also listing PHP code injection in WebCalendar 1.2.4. The common impact is arbitrary file read and potential code execution within the vulnerable web application con...