PT-2024-14465 · Google · Private Google Calendars

Name of the Vulnerable Software and Affected Versions: Michiel van Eerd Private Google Calendars versions from n/a through 20231125 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This...

WordPress Private Google Calendars Plugin <= 20231125 is vulnerable to Cross Site Scripting (XSS)

Software Private Google Calendars Type Plugin Vulnerable versions = 20231125 Fixed in 20240106 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52198 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e9587eb47eeb Credits Ngô Thiên An ancorn fro...

CVE-2022-36399

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4...

CVE-2022-36399

CVE-2022-36399 affects the WordPress plugin Booked - Appointment Booking for WordPress (up to version before 2.4.4). It exposes sensitive data to unauthenticated actors due to improper access control. Fixed in version 2.4.4. Upgrading to 2.4.4+ mitigates the issue; no exploit details are provided...

WordPress Date Picker by Input WP – Sync bookings with external Calendars (.ics) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software Date Picker by Input WP – Sync bookings with external Calendars .ics Type Plugin Vulnerable versions = 2.2 Fixed in 2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WebCalendar 跨站脚本漏洞

WebCalendar is a PHP application for maintaining calendars for individual users or groups of Intranet users. It can also be configured as an event calendar. WebCalendar suffers from a cross-site scripting vulnerability that originates from an attacker being able to implement stored cross-site...

[SECURITY] Fedora 36 Update: nextcloud-25.0.1-1.fc36

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

CVE-2022-3852

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...

WordPress plugin VR Calendar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2022-7400 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.4 Description: The issue is related to the usage of RSS feeds or an external calendar in planning, which is subject to a Server-Side Request Forgery SSRF exploit. If a remote script returns a redirect response, the...

PT-2022-7406 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.3 Description: The issue is related to the usage of RSS feeds or external calendar in planning, which is subject to Server-Side Request Forgery SSRF exploit. This allows an attacker to scan server ports or services...

GLPI 代码问题漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the username, lastname, or surname fields in user profiles. A user can insert a malicious payload in their own calendar, which may be reflected and executed when accessed by other users' calendars. This is a...

MoinMoin Improper ACL handling for calendars and includes

MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors...

CVE-2021-41112

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could...

Authorization

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could...

CVE-2021-41112 Missing Authorization in Rundeck

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could...

WordPress Date Picker by Input WP – Sync bookings with external Calendars (.ics) plugin <= 2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin versions = 2.1. Solution Update the WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin to the latest available...

Rundeck 安全漏洞

Rundeck is an open source automation service with a web console, command line tools, and webAPI from Rundeck, Inc. in the United States, which is primarily used to run automation tasks. A security vulnerability in versions of Rundeck prior to 3.4.5 allows authenticated users to make requests to...

Microsoft Outlook for Mac Security Feature Bypass Vulnerability

Microsoft Outlook for Mac is a Mac-based email client software bundled with the Office suite from Microsoft Corporation. The software manages email, contacts, calendars, etc. Microsoft Outlook for Mac has a security vulnerability for which no detailed vulnerability details are available...