{"id":"USN-9050-1","summary":"davical vulnerabilities","details":"It was discovered that DAViCal did not properly encode certain request\nparameters, leading to a reflected cross-site scripting vulnerability. A\nremote attacker could possibly use this issue to perform actions as another\nuser, including adding administrator accounts. (CVE-2019-18345)\n\nIt was discovered that DAViCal did not protect against cross-site request\nforgery. A remote attacker could possibly use this issue to perform actions\nas an authenticated user, including adding administrator accounts.\n(CVE-2019-18346)\n\nIt was discovered that DAViCal did not properly sanitize certain user\naccount fields, leading to a stored cross-site scripting vulnerability. An\nauthenticated user could possibly use this issue to execute arbitrary\nscript in the browser of another user, including an administrator.\n(CVE-2019-18347)","modified":"2026-11-12T17:29:28.809892049Z","published":"2026-11-11T18:31:46Z","related":["UBUNTU-CVE-2019-18345","UBUNTU-CVE-2019-18346","UBUNTU-CVE-2019-18347"],"upstream":["CVE-2019-18345","CVE-2019-18346","CVE-2019-18347","UBUNTU-CVE-2019-18345","UBUNTU-CVE-2019-18346","UBUNTU-CVE-2019-18347"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-9050-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-18345"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-18346"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-18347"}],"affected":[{"package":{"name":"davical","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/davical?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-1ubuntu0.1~esm1"}]}],"versions":["1.1.5-1","1.1.6-1","1.1.7-1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"davical","binary_version":"1.1.7-1ubuntu0.1~esm1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"id":"CVE-2019-18345","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2019-18346"},{"id":"CVE-2019-18347","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"score":"medium","type":"Ubuntu"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9050-1.json"}}],"schema_version":"1.9.2"}