Bug#404234: CVE-2006-6669: WebCalendar XSS

2006-12-28 Thread Steve Langasek
severity 404234 important thanks On Fri, Dec 22, 2006 at 06:51:46PM +0100, Stefan Fritsch wrote: > Package: webcalendar > Severity: grave > Tags: security > Justification: user security hole > A vulnerability has been found in webcalender: > Cross-site scripting (XSS) vulnerability in export_han

Processed: Re: Bug#404234: CVE-2006-6669: WebCalendar XSS

2006-12-28 Thread Debian Bug Tracking System
Processing commands for [EMAIL PROTECTED]: > severity 404234 important Bug#404234: CVE-2006-6669: WebCalendar XSS Severity set to `important' from `grave' > thanks Stopping processing here. Please contact me if you need assistance. Debian bug tracking system administrato

Bug#404234: CVE-2006-6669: WebCalendar XSS

2006-12-23 Thread Stefan Fritsch
On Saturday 23 December 2006 10:00, Thijs Kinkhorst wrote: > I haven't found a concrete way to exploit it yet, since some HTML > inputs are stripped from all input parameters. A concrete example > would help to confirm the status of this bug. Do you have one? This page gives an example. http://ww

Bug#404234: CVE-2006-6669: WebCalendar XSS

2006-12-23 Thread Thijs Kinkhorst
tags 404234 patch moreinfo thanks Hi, > A vulnerability has been found in webcalender: > > Cross-site scripting (XSS) vulnerability in export_handler.php in > WebCalendar 1.0.4 and earlier allows remote attackers to inject > arbitrary web script or HTML via the format parameter. I can see what

Bug#404234: CVE-2006-6669: WebCalendar XSS

2006-12-22 Thread Stefan Fritsch
Package: webcalendar Severity: grave Tags: security Justification: user security hole A vulnerability has been found in webcalender: Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via t