CVE-2006-6066

Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to a adminlogin.asp, the 3 ID parameter to b eventsearchdetail.asp, or the 4 VenueID parameter to c venuedetail.asp...

PT-2006-6711 · Dragon · Dragon Calendar / Events Listing

Name of the Vulnerable Software and Affected Versions: Dragon Calendar / Events Listing versions 2.x Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the username or password parameter to the "admin login.asp" API endpoint, the ID paramete...

CVE-2006-6030

Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd Password fields in a admin/default.asp; or the 3 Event Title, 4 Location, or 5 Description field when making a search engine query in b search.asp...

CVE-2006-6030

Multiple SQL injection vulnerabilities affect E-Calendar Pro 3.0. Remote attackers can execute arbitrary SQL via (1) username and (2) passwd fields in admin/default.asp or (3) Event Title, (4) Location, or (5) Description in search.asp, as described for CVE-2006-6030. The underlying issue is impr...

CVE-2006-6030

Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd Password fields in a admin/default.asp; or the 3 Event Title, 4 Location, or 5 Description field when making a search engine query in b search.asp...

E-Calendar Pro 3.0 [ login bypass & injection sql (post)]

vendor site:http://www.futuretec-soft.com/ product:E-Calendar Pro 3.0 bug:login bypass & injection sql post risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql post: in : /search.asp post your query into the search engine . laurent gaffie & benjamin mosse http://s-a-p.ca/...

Dragon calendar [ login bypass & injection sql ]

vendor site:http://www.dragoninternet.net/ product:Dragon Events Listing bug:login bypass & injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql get http://site.com/eventsearchdetail.asp?ID='sql http://site.com/venuedetail.asp?VenueID='sql laurent gaffie & benjam...

Solaris 8 (i386) : 116578-42

The remote host is missing Sun Security Patch number 116578-42 Calendar Server SunOS 5.8x86 5.9x86 5.10x86: Core patch. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...

Solaris 10 (i386) : 116578-42

The remote host is missing Sun Security Patch number 116578-42 Calendar Server SunOS 5.8x86 5.9x86 5.10x86: Core patch. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...

Solaris 9 (i386) : 116578-42

The remote host is missing Sun Security Patch number 116578-42 Calendar Server SunOS 5.8x86 5.9x86 5.10x86: Core patch. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...

Solaris 8 (sparc) : 116577-42

The remote host is missing Sun Security Patch number 116577-42 Calendar Server SunOS 5.8 5.9 5.10: Core patch. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended...

Solaris 9 (sparc) : 116577-42

The remote host is missing Sun Security Patch number 116577-42 Calendar Server SunOS 5.8 5.9 5.10: Core patch. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended...

PhpGroupWare日历模块class.holidaycalc.inc.php本地文件包含漏洞

phpGroupWare是一个用PHP编写的多用户的网络组件，为开发其他程序提供了一个API。 phpGroupWare在处理用户请求时存在输入验证，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 phpGroupWare的calendar/inc/class.holidaycalc.inc.php脚本没有正确验证phpgwinfouserpreferencescommoncountry参数的输入，远程攻击者可以通过包含本地资源的任意文件导致执行任意代码。成功攻击要求打开了registerglobals且禁用了magicquotesgpc PHPGroupWare...

Virtual Law Office - 'phpc_root_path' Remote File Inclusion

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Virtual Law Office phpcrootpath Remote File Include Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Author: xoron Tum islam aleminin Ramazan Bayrami...

CVE-2006-5426

PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbitrary PHP code via a URL in the LIBDIR parameter...

CVE-2006-5426

PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbitrary PHP code via a URL in the LIBDIR parameter...

CVE-2006-5426

CVE-2006-5426 affects LoCal Calendar System 1.1. A vulnerability in the file lib/lcUser.php allows remote attackers to execute arbitrary PHP code via a URL supplied to the LIBDIR parameter, due to a remote file inclusion vulnerability. The CVE entry indicates this is a PHP RFI with potential impa...

LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion

+------------------------------------------------------------------------------------------- local Calendar System v1.1 lcUser.php Remote File Include --------------------------------------------------------------------------------------------- An advanced instrumentation reservation system for...

LoCal Calendar 1.1 - lcUser.php Remote File Inclusion

LoCal Calendar 1.1 - lcUser.php Remote File Inclusion +------------------------------------------------------------------------------------------- local Calendar System v1.1 lcUser.php Remote File Include --------------------------------------------------------------------------------------------...

Debian DSA-1056-1 : webcalendar - verbose error message

David Maciejak noticed that webcalendar, a PHP-based multi-user calendar, returns different error messages on login attempts for an invalid password and a non-existing user, allowing remote attackers to gain information about valid usernames. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...