Vulnerabilities

TI-2009-04730 CVE-2009-4974 · GHSA-jhpx-m76h-97q9

Directory traversal vulnerability in box_display.php in TotalCalendar 2.4 allows remote…

LOW 37

Directory traversal vulnerability in box_display.php in TotalCalendar 2.4 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a ..

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0232 Published 2010-07-27 No fix listed CWE-22

TI-2009-04729 CVE-2009-4973 · GHSA-3j44-xcrg-v77q

SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to…

LOW 35

SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00947 Published 2010-07-27 No fix listed CWE-89

TI-2009-04685 CVE-2009-4929 · GHSA-f2r2-9848-78f4

admin/manage_users.php in TotalCalendar 2.4 does not require administrative…

LOW 38

admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02455 Published 2010-07-09 No fix listed CWE-287

TI-2009-04684 CVE-2009-4928 · GHSA-5vcw-72h8-x9g2

PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote…

LOW 36

PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01316 Published 2010-07-09 No fix listed CWE-94

TI-2009-01330 CVE-2009-1406 · GHSA-3ph4-q4px-cwq5

Directory traversal vulnerability in cms_detect.php in TotalCalendar 2.4 allows remote…

LOW 34

Directory traversal vulnerability in cms_detect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local files via a ..

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01896 Published 2009-04-24 No fix listed CWE-22

TI-2007-03408 CVE-2007-3515 · GHSA-wwx9-h5pq-vhh5

SQL injection vulnerability in view_event.php in TotalCalendar 2.402 and earlier allows…

MEDIUM 46

SQL injection vulnerability in view_event.php in TotalCalendar 2.402 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01821 Published 2007-07-03 No fix listed

TI-2006-06797 CVE-2006-7055 · GHSA-3f7x-25p9-vp9m

PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier…

LOW 39

PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attackers to execute arbitrary code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.056 Published 2007-02-24 No fix listed

TI-2006-01867 CVE-2006-1922 · GHSA-hv63-698c-9x4g

PHP remote file inclusion vulnerability in (1) about.php or (2) auth.php in TotalCalendar…

LOW 34

PHP remote file inclusion vulnerability in (1) about.php or (2) auth.php in TotalCalendar allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03071 Published 2006-04-20 No fix listed

Vulnerabilities

Filters