298 matches found
PHP iCalendar 1.1/2.x - 'week.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/21792/info PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...
PHP iCalendar 1.1/2.x - 'day.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/21792/info PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...
PHP iCalendar 1.1/2.x - 'print.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/21792/info PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...
PHP iCalendar 1.1/2.x - 'year.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/21792/info PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...
PHP iCalendar 1.1/2.x - 'preferences.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/21792/info PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...
PHP iCalendar 1.1/2.x - 'search.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/21792/info PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...
CVE-2006-3319
Cross-site scripting XSS vulnerability in rss/index.php in PHP iCalendar 2.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the cal parameter...
CVE-2006-3319
The CVE-2006-3319 entry corresponds to a Cross-site scripting (XSS) vulnerability in the rss/index.php file of PHP iCalendar 2.22 and earlier. The underlying issue is an injection of arbitrary web script/HTML via the cal parameter, allowing remote attackers to execute injected scripts in victims’...
CVE-2006-3319
Cross-site scripting XSS vulnerability in rss/index.php in PHP iCalendar 2.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the cal parameter...
PHP iCalendar Cross Site Scripting
K.S Advisory irc.gigachat.net kurdhack Thanx : Netqurd,Azad,B3g0k,Fearless,Milex,Flot,ZayBoy,PH,KHA,KCA and other my friends Version : All Version Proof Of Concept : http://www.site.com/phpicalendar/rss/index.php?cal=XSS Original Advisory :...
CVE-2006-1292
Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the phpicalendarcookielanguage and phpicalendarcookiestyle cookies, as...
Directory traversal
Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the phpicalendarcookielanguage and phpicalendarcookiestyle cookies, as...
Authentication flaw
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and...
CVE-2006-1291
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and...
CVE-2006-1292
CVE-2006-1292 is a directory-traversal vulnerability in PHP iCalendar 2.21 and earlier. An attacker can cause local file inclusion and remote code execution by manipulating cookies phpicalendar[cookie_language] and phpicalendar[cookie_style] (with a NUL/%00) so that PHP sequences injected into an...
CVE-2006-1291
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and...
CVE-2006-1292
Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the phpicalendarcookielanguage and phpicalendarcookiestyle cookies, as...
CVE-2006-1291
CVE-2006-1291 affects PHP iCalendar versions prior to 2.25. The vulnerability allows remote attackers to upload and execute arbitrary PHP scripts by exploiting unauthenticated write access to the calendars directory via a WebDAV PUT request with a filename ending in .php plus a trailing null char...
PHP iCalendar publish.ical.php Arbitrary File Upload
The remote host appears to be running PHP iCalendar, a web-based iCal file viewer / parser written in PHP. The installed version of PHP iCalendar supports iCal publishing but does not properly restrict the types of files uploaded and places them in a web-accessible directory. An unauthenticated...