davical vulnerabilities

It was discovered that DAViCal did not properly encode certain request
parameters, leading to a reflected cross-site scripting vulnerability. A
remote attacker could possibly use this issue to perform actions as another
user, including adding administrator accounts. (CVE-2019-18345)

It was discovered that DAViCal did not protect against cross-site request
forgery. A remote attacker could possibly use this issue to perform actions
as an authenticated user, including adding administrator accounts.
(CVE-2019-18346)

It was discovered that DAViCal did not properly sanitize certain user
account fields, leading to a stored cross-site scripting vulnerability. An
authenticated user could possibly use this issue to execute arbitrary
script in the browser of another user, including an administrator.
(CVE-2019-18347)