CVE-2004-1530

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the 1 eid or 2 cid parameters...

CVE-2004-1528

The Event Calendar module 2.13 for PHP-Nuke allows remote attackers to gain sensitive information via an HTTP request to 1 config.php, 2 index.php, or 3 submit.php, which reveal the full path in an error message...

CVE-2004-1529

CVE-2004-1529 refers to a Cross-site Scripting (XSS) vulnerability in the Event Calendar module 2.13 for PHP-Nuke. The issue allows remote attackers to trigger script execution by supplying malicious input in the Preview operation via the parameters (type, day, month, year) or in event comments. ...

CVE-2004-1467

Multiple cross-site scripting XSS vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 date or search text field in the calendar module, 2 Field parameter, Filter parameter, QField parameter, Start parameter or Search field in th...

CVE-2004-1467

Multiple cross-site scripting XSS vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 date or search text field in the calendar module, 2 Field parameter, Filter parameter, QField parameter, Start parameter or Search field in th...

CVE-2004-1529

Cross-site scripting XSS vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary web script via the 1 type, 2 day, 3 month, or 4 year parameters in a Preview operation, or 5 event comments...

CVE-2004-1530

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the 1 eid or 2 cid parameters...

CVE-2004-1528

The Event Calendar module 2.13 for PHP-Nuke allows remote attackers to gain sensitive information via an HTTP request to 1 config.php, 2 index.php, or 3 submit.php, which reveal the full path in an error message...

[waraxe-2004-SA#038 - Multiple vulnerabilities in Event Calendar module for PhpNuke]

================================================================================ waraxe-2004-SA038 ================================================================================ Multiple vulnerabilities in Event Calendar module for PhpNuke...

Debian DSA-419-1 : phpgroupware - missing filename sanitising, SQL injection

The authors of phpgroupware, a web-based groupware system written in PHP, discovered several vulnerabilities. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2004-0016 In the 'calendar' module, 'save extension' was not enforced for holiday files. As a...

CVE-2004-0016

Summary (CVE-2004-0016) : The phpGroupWare calendar module (version 0.9.14) fails to enforce the save extension for holiday files, allowing server-side PHP files to be created and executed. This is a remote vulnerability with a CVSS v2 base score of 7.5 (High). Related advisories patch the issue ...

Multiple Cross Site Scripting Vulnerabilities in eGroupWare

--------------------------------------------------------------------------- Multiple Cross Site Scripting Vulnerabilities in eGroupWare --------------------------------------------------------------------------- Author: Joxean Koret Date: 2004 Location: Basque Country...

eGroupWare 1.0 Calendar Module - date Cross-Site Scripting

eGroupWare 1.0 Calendar Module - date Cross-Site Scripting source: https://www.securityfocus.com/bid/11013/info It is reported that eGroupWare is susceptible to multiple cross-site scripting and HTML injection vulnerabilities. The cross-site scripting issues present themselves in the various...

CVE-2004-0016

The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files...

DSA-419 phpgroupware - missing filename sanitising, SQL injection

Bulletin has no description...

CVE-2003-0735

SQL injection vulnerability in the Calendar module of phpWebSite 0.9.x and earlier allows remote attackers to execute arbitrary SQL queries, as demonstrated using the year parameter...

CVE-2003-0737

The calendar module in phpWebSite 0.9.x and earlier allows remote attackers to obtain the full pathname of phpWebSite via an invalid year, which generates an error from localtime in TimeZone.php of the Pear library...

CVE-2003-0738

The calendar module in phpWebSite 0.9.x and earlier allows remote attackers to cause a denial of service crash via a long year parameter...

CVE-2003-0735

SQL injection vulnerability in the Calendar module of phpWebSite 0.9.x and earlier allows remote attackers to execute arbitrary SQL queries, as demonstrated using the year parameter...

CVE-2003-0737

CVE-2003-0737 : The calendar module of phpWebSite 0.9.x and earlier allows remote attackers to obtain the full pathname of phpWebSite by triggering an error from localtime() in TimeZone.php (Pear library) via an invalid year. The issue is web-accessible (network vector) with no authentication, an...