DSA-970-1 kronolith - missing input sanitising

Bulletin has no description...

Sql injection

Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 $totallogin and 2 $totalpassword parameter...

CVE-2006-0673

Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 $totallogin and 2 $totalpassword parameter...

CVE-2006-0673

CVE-2006-0673 affects Magic Calendar Lite 1.02. The vulnerability is a SQL injection in cms/index.php, exploitable when magic_quotes_gpc is off, via the parameters $total_login and $total_password . Outcomes include unauthorized SQL command execution against the backend. Public sources (NVD and e...

Cross site scripting

Cross-site scripting XSS vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the 1 username and 2 password parameters, which are not sanitized before being written to users.php. NOTE: while this issue...

CVE-2006-0657

Cross-site scripting XSS vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the 1 username and 2 password parameters, which are not sanitized before being written to users.php. NOTE: while this issue...

CVE-2006-0657

CVE-2006-0657 affects Softcomplex’s PHP Event Calendar 1.5. The issue is a vulnerability in the usernames/passwords handling, where inputs are written to users.php without sanitization, enabling potential cross‑site scripting (XSS) or direct static code injection that could corrupt data. Descript...

CVE-2006-0657

Cross-site scripting XSS vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the 1 username and 2 password parameters, which are not sanitized before being written to users.php. NOTE: while this issue...

[SA18781] 2200net Calendar System SQL Injection Vulnerabilities

TITLE: 2200net Calendar System SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA18781 VERIFY ADVISORY: http://secunia.com/advisories/18781/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: 2200net Calendar System 1.x...

[SA18792] PHP Event Calendar User Information Manipulation

TITLE: PHP Event Calendar User Information Manipulation SECUNIA ADVISORY ID: SA18792 VERIFY ADVISORY: http://secunia.com/advisories/18792/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: PHP Event Calendar 1.x http://secunia.com/product/7964...

Sql injection

Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpcmagicquotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via 1 the fmdataid parameter to calendar.php and 2 the $ad'acc' variable in adminlogin.php...

CVE-2006-0610

Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpcmagicquotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via 1 the fmdataid parameter to calendar.php and 2 the $ad'acc' variable in adminlogin.php...

CVE-2006-0610

The CVE-2006-0610 entry relates to the 2200net Calendar system (version 1.2). Two vulnerable vectors are identified: (1) calendar.php where fm_data[id] can be injected to modify SQL queries, and (2) adminlogin.php where $ad['acc'] can be manipulated. Affected condition: magic_quotes_gpc must be o...

CVE-2006-0610

Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpcmagicquotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via 1 the fmdataid parameter to calendar.php and 2 the $ad'acc' variable in adminlogin.php...

PluggedOut-1.9.9c.txt

PluggedOut Blog SQL INJECTION and XSS PluggedOut Blog is an open source script you can run on your web server to give you an online multi-user journal or diary. It can be used equally well for any kind of calendar application.Rather than give you a thousand things you don't really want...

PluggedOut Blog SQL injection and XSS

PluggedOut Blog SQL INJECTION and XSS PluggedOut Blog is an open source script you can run on your web server to give you an online multi-user journal or diary. It can be used equally well for any kind of calendar application.Rather than give you a thousand things you don't really want...

EV0030.txt

New eVuln Advisory: Benders Calendar SQL Injection http://evuln.com/vulns/30/summary/bt/ --------------------Summary---------------- Software: Benders Calendar Sowtware's Web Site: http://sourceforge.net/projects/benderscalendar/ Versions: 1.0 Critical Level: Harmless Type: SQL Injection Class:...

EV0029.txt

New eVuln Advisory: Light Weight Calendar PHP Code Execution http://evuln.com/vulns/29/summary.html --------------------Summary---------------- Software: Light Weight Calendar Sowtware's Web Site: http://sourceforge.net/projects/lwcal/ Versions: 1.0 Critical Level: Dangerous Type: PHP Code...

CVE-2006-0252

CVE-2006-0252 describes an SQL injection in Benders Calendar 1.0 exposed via the index.php this_day/parameters (year, month, day). The vulnerability allows a remote attacker to execute arbitrary SQL commands. Connected advisories confirm remote SQL execution via these parameters; no specific patc...

CVE-2006-0252

SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the 1 year, 2 month, and 3 day parameters...