davscan

DAVScan DAVScanは、WebDAVが有効なウェブサーバ上で隠しファイルやフォルダを発見するために設計された、高速かつ軽量なWebDAVスキャナです。 このスキャナは、過度に特権が設定されたり誤設定されたWebDAVサーバや、さまざまな情報漏洩や認証バイパスの脆弱性があるサーバを悪用することで動作します。スキャナは対象サーバのフィンガープリントを取得し、ルートのPROPFINDリクエストの結果に基づいてサーバをクロールします。 注意点: もし私の酷いコードを実際に読む時間を取るなら、davscanの中核部分をBeautiful...

cve-2017-7269

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services IIS 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: http://" in a PROPFIND request, as exploited in the wild ...

CVE-2017-7269

CVE-2017-7269 - IIS 6.0 WebDAV Buffer Overflow Реализация POC для CVE-2017-7269 на языке Rust, нацеленная на службу WebDAV в Microsoft Internet Information Services IIS 6.0. Обзор уязвимости CVE-2017-7269 — это критическая уязвимость переполнения буфера на основе стека, обнаруженная в службе WebD...

WebDavC2

WebDAVC2 최신/현재 버전: 0.3 저자: Arno0x0x - @Arno0x0x WebDavC2는 WebDAV 프로토콜을 PROPFIND 전용 요청 만 사용하여, 대상 시스템에서 실행되는 에이전트와 실제 C2 서버 역할을 하는 컨트롤러 간의 C2 통신 채널로 활용하는 PoC개념 증명입니다. 이 도구는 GPLv3 라이선스 조건에 따라 배포됩니다. 배경 정보 WebDAV PROPFIND 전용 요청을 C2 채널로 사용하는 방법과 그 이유 에 대한 블로그 게시물을 확인하세요: Wordpress: 은닉 채널로서 WebDAV 기능...

CVE-2017-7269

CVE-2017-7269 Идентификатор уязвимости: CVE-2017-7269 Обнаружено: Zhiniang Peng и Chen Wu Лаборатория информационной безопасности Южно-китайского технологического университета, Школа компьютерных наук и инженерии Описание уязвимости: IIS 6.0 по умолчанию не включает WebDAV; при включении поддержк...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

Security update for tomcat11

This update for tomcat11 fixes the following issues Update to Tomcat 11.0.22: CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. CVE-2026-42498: WebSocket authentication header exposure bsc1265165...

USN-8417-1: Tomcat vulnerabilities

It was discovered that Tomcat did not properly limit the size of WebDAV LOCK and PROPFIND request bodies. A remote attacker could use this issue to cause Tomcat to consume excessive memory, resulting in a denial of service. CVE-2026-41284 It was discovered that Tomcat incorrectly validated HTTP/2...

USN-8417-1 tomcat9, tomcat10 vulnerabilities

It was discovered that Tomcat did not properly limit the size of WebDAV LOCK and PROPFIND request bodies. A remote attacker could use this issue to cause Tomcat to consume excessive memory, resulting in a denial of service. CVE-2026-41284 It was discovered that Tomcat incorrectly validated HTTP/2...

CVE-2026-45810 Nextcloud: Propfind requests for file comments allowed to load comments for other files

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended th...

CVE-2026-45810 Nextcloud: Propfind requests for file comments allowed to load comments for other files

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended th...

CVE-2026-45810 Nextcloud: Propfind requests for file comments allowed to load comments for other files

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended th...

tomcat6: Fix of CVE-2026-41284

CVE-2026-41284: tomcat6: WebDAV LOCK/PROPFIND unbounded request body DoS...

Propfind requests for file comments allowed to load comments for other files

None...

BIT-TOMCAT-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to versio...

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected Description: No limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to...

GHSA-GX5V-XP9W-J4CG Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected Description: No limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to...