CVE-2012-5384

Multiple cross-site scripting XSS vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the 1 $name or 2 $description variables in editentryhandler.php, or 3 $url, 4 $tempfullname, or 5 $extusers variables in viewentry.php, different vector...

CVE-2013-1421

CVE-2013-1421 affects Craig Knudsen WebCalendar prior to 1.2.7 (including 1.2.5 and 1.2.6). The issue is a Cross-Site Scripting (XSS) vulnerability in the Category Name field processed by category.php, enabling remote attackers to inject arbitrary web script or HTML. Affected versions and impact ...

CVE-2013-1421: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php...

CVE-2012-5384

CVE-2012-5384 and related entries describe multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar. The flaws allow remote attackers to inject arbitrary script/HTML by manipulating parameters in edit_entry_handler.php (name/description) and view_entry.php (url, tempfullna...

CVE-2012-5384: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the 1 $name or 2 $description variables in editentryhandler.php, or 3 $url, 4 $tempfullname, or 5 $extusers variables in viewentry.php, different vector...

CVE-2012-5385: Undefined Security Weakness

install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference...

CVE-2012-0846: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable...

Remote file inclusion

includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that...

CVE-2007-1343: Undefined Security Weakness

includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that...

CVE-2006-1537: Undefined Security Weakness

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to 1 includes/index.php, 2 tests/adddurationtest.php, 3 tests/alltests.php, 4 groups.php, 5 nonusers.php, 6 includes/settings.php, 7 includes/init.php, 8 includes/settings.php.orig, 9...