CVE-2006-0924: Cross-site scripting (XSS) vulnerability in Brown Bear iCal 3.10 allows remote attackers to inject arbitrar...

Security readout for executives and security teams

Brown Bear iCal 3.10 reportedly lets an attacker place web script or HTML into the Calendar Text field when adding an event. If other users view that event, their browsers may run attacker-controlled content. The record says the provenance is unknown and details come only from third-party information. Exposure is likely limited to organizations still running Brown Bear iCal 3.10 where event creation is reachable by untrusted or semi-trusted users and event text is viewed in a browser. Treat this as a legacy web application risk. Priority depends on whether Brown Bear iCal 3.10 is still deployed and exposed to untrusted users. If present and unsupported, replacement or isolation is the practical path. Mitigation focus: Inventory any Brown Bear iCal deployments and confirm whether version 3.10 is present.; Check Brown Bear or trusted legacy advisory guidance for patched versions or supported mitigations.; Restrict event creation to trusted authenticated users until exposure is resolved..

Prepared

Jun 29, 2026, 14:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.