|
|
CVE Reference: CVE-2007-1343 |
|
| NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE. | |
|
Original Page at CVE MITRE: CVE-2007-1343 |
|
|
Description: includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues. |
|
|
CVE Status: Candidate |
|
|
References: XF http://xforce.iss.net/xforce/xfdb/32832 SAID Secunia Advisory: SA24403 Secunia Advisory: SA24519 MLIST http://sourceforge.net/mailarchive/forum.php?thread_id=31840112&forum_id=46247 DEBIAN http://www.debian.org/security/2007/dsa-1267 CONFIRM http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?r1=1.211.2.7&r2=1.211.2.8 http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?view=log http://sourceforge.net/project/shownotes.php?group_id=3870&release_id=491130 BID 22834 |
|
| Return to the previous page. |
