Vulnerabilities > K5N
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-10-08 | CVE-2012-0846 | Cross-Site Scripting vulnerability in K5N Webcalendar 1.2.4 Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable. | 4.3 |
| 2011-09-24 | CVE-2011-3814 | Information Exposure vulnerability in K5N Webcalendar 1.2.3 WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by ws/user_mod.php and certain other files. | 5.0 |
| 2010-02-15 | CVE-2010-0638 | Cross-Site Request Forgery (CSRF) vulnerability in K5N Webcalendar 1.2.0 Cross-site request forgery (CSRF) vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. | 6.8 |
| 2010-02-12 | CVE-2010-0637 | Cross-Site Request Forgery (CSRF) vulnerability in K5N Webcalendar 1.2.0 Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that (1) delete an event or (2) ban an IP address from posting via unknown vectors. | 6.8 |
| 2010-02-12 | CVE-2010-0636 | Cross-Site Scripting vulnerability in K5N Webcalendar 1.2.0 Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php, (3) month.php, and (4) week.php. | 4.3 |
| 2008-06-24 | CVE-2008-2836 | Code Injection vulnerability in K5N Webcalendar 1.0.4 PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter and a 0 value for the noSet parameter, a different vector than CVE-2007-1483. | 7.5 |
| 2007-03-16 | CVE-2007-1483 | Code Injection vulnerability in K5N Webcalendar 0.9.45 Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP code via a URL in the includedir parameter to (1) login.php, (2) get_reminders.php, or (3) get_events.php. | 7.5 |