Webcalendar Webcalendar
20 CVEs affecting Webcalendar Webcalendar. Latest disclosed: 2008-02-01. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2007-6696 | | 2008-02-01 | Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event descrip… | |
CVE-2007-1343 | | 2007-03-08 | includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers… | |
CVE-2006-6669 | | 2006-12-20 | Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2006-2762 | | 2006-06-02 | PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the incl… | |
CVE-2006-2247 | | 2006-05-09 | WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid… | |
CVE-2006-1537 | | 2006-03-30 | Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to (1) includes/index.php, (2) tests/add_durat… | |
CVE-2005-3984 | | 2005-12-04 | SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time_range parameter to edit_report_handler… | |
CVE-2005-3982 | | 2005-12-04 | CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting… | |
CVE-2005-3961 | | 2005-12-01 | export_handler.php in WebCalendar 1.0.1 allows remote attackers to overwrite WebCalendar data files via a modified id parameter. | |
CVE-2005-3949 | | 2005-12-01 | Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_… | |
CVE-2005-2717 | | 2005-08-29 | PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly v… | |
CVE-2005-2320 | | 2005-07-19 | WebCalendar before 1.0.0 does not properly restrict access to assistant_edit.php, which allows remote attackers to gain privileges. | |
CVE-2005-0474 | | 2005-03-30 | SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an… | |
CVE-2004-1510 | | 2004-12-31 | WebCalendar allows remote attackers to gain privileges by modifying critical parameters to (1) view_entry.php or (2) upcoming.php. | |
CVE-2004-1509 | | 2004-12-31 | validate.php in WebCalendar allows remote attackers to gain sensitive information via an invalid encoded_login parameter, which reveals the full path in an err… | |
CVE-2004-1508 | | 2004-12-31 | init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the user_inc parameter. | |
CVE-2004-1507 | | 2004-12-31 | CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the return_path parameter and perform HTTP Respon… | |
CVE-2004-1506 | | 2004-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via (1) view_entry.php, (2) view_d.php… | |
CVE-2002-2065 | | 2002-12-31 | WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from… | |
CVE-2001-0477 | | 2001-06-27 | Vulnerability in WebCalendar 0.9.26 allows remote command execution. |