RSS   Vulnerabilities for 'Calendar project'   RSS

2006-01-12
 
CVE-2006-0183

CWE-Other
 

 
Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php, or (2) the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from the poor authentication as identified by CVE-2006-0182. Since the design of the product allows the administrator to edit the code, perhaps this issue should not be included in CVE, except as a consequence of CVE-2006-0182.

 
 
CVE-2006-0182

CWE-Other
 

 
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".

 

 >>> Vendor: ACAL 2 Products
Calendar project
ACAL


Copyright 2024, cxsecurity.com

 

Back to Top