RSS   Vulnerabilities for 'Calendar'   RSS

2022-04-11
 
CVE-2022-24838

CWE-77
 

 
Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available.

 
2018-07-05
 
CVE-2018-3763

CWE-79
 

 
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.

 

 >>> Vendor: Nextcloud 18 Products
MAIL
Desktop
TALK
Server
NEWS
Calendar
Nextcloud
Nextcloud server
Lookup-server
Circles
DECK
Group folders
Nextcloud mail
Contacts
Preferred providers
Social
Richdocuments
Officeonline


Copyright 2024, cxsecurity.com

 

Back to Top