Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:136)

Multiple security vulnerabilities has been identified and fixed in tomcat5 : When Tomcat's WebDAV servlet is configured for use with a context and has been enabled for write, some WebDAV requests that specify an entity with a SYSTEM tag can result in the contents of arbitary files being returned ...

XSS vulnerability can be exploited on the WebDAV Configuration page

Steps: Go to WebDAV Configuration Enter 'alert"XSS"' Click on 'Add new regex' button The script will be executed. It will continue to be executed whenever a user clicks on the 'Save' button. This can be done by users in the confluence-admin group, so it could be used by them to gain access to...

XSS vulnerability can be exploited on the WebDAV Configuration page

Steps: Go to WebDAV Configuration Enter 'alert"XSS"' Click on 'Add new regex' button The script will be executed. It will continue to be executed whenever a user clicks on the 'Save' button. This can be done by users in the confluence-admin group, so it could be used by them to gain access to...

XSS vulnerability can be exploited on the WebDAV Configuration page

Steps: Go to WebDAV Configuration Enter 'alert"XSS"' Click on 'Add new regex' button The script will be executed. It will continue to be executed whenever a user clicks on the 'Save' button. This can be done by users in the confluence-admin group, so it could be used by them to gain access to...

Microsoft IIS 5.0 WebDAV绕过认证漏洞(MS09-020)

BUGTRAQ ID: 35232 CVECAN ID: CVE-2009-1122 Microsoft Internet信息服务（IIS）是Microsoft Windows自带的一个网络信息服务器，其中包含HTTP服务功能。 IIS的WebDAV扩展没有正确解码特制请求的URL，导致WebDAV在处理该请求时应用不正确的配置。如果应用的配置允许匿名访问，则特制的请求可以绕过身份验证。 请注意IIS在配置的匿名用户帐户的安全上下文中仍会处理该请求，因此此漏洞不能用于绕过NTFS ACL，文件系统ACL对匿名用户帐户强加的限制将仍然执行。 Microsoft IIS 5.0 临时解决方法...

For IIS write permissions for the simple analysis-vulnerability warning-the black bar safety net

//Or to be symbolic of a copyright, reproduced, please indicate the b0r3d's blog http://www.b0r3d.org //Last month to the Black hand cast went, people since there is no published, I will send to it, after all the articles of original content is too small, the technical content is not high. Recent...

Authentication flaw

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

CVE-2009-1122

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

CVE-2009-1122

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

CVE-2009-1122

CVE-2009-1122 is the IIS WebDAV authentication bypass vulnerability associated with the MS09-020 family. The Initial Description notes an improper URL decode in IIS WebDAV that can bypass authentication and allow reading/creating files via crafted HTTP requests. Connected documents corroborate an...

CVE-2009-1535

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

Authentication flaw

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

CVE-2009-1535

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

CVE-2009-1535

CVE-2009-1535 corresponds to the IIS WebDAV Unicode authentication bypass vulnerability affecting IIS 5.1/6.0. The issue permits remote bypass of URI-based protections and can allow listing, reading, creation, or modification of files by injecting a Unicode sequence (notably %c0%af) into the URI,...

CVE-2009-1122: Improper Authentication

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

CVE-2009-1535: Improper Authentication

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

Microsoft IIS Security Bypass Vulnerability (970483)

This host is missing a critical security update according to Microsoft Bulletin MS09-020. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft unleashes 31 fixes on Patch Tuesday

From ZDNet Ryan Naraine Microsoft’s batch of patches this month is a big one: 10 bulletins covering a total of 31 documented vulnerabilities affecting the Windows OS, the Internet Explorer browser and the Microsoft Office productivity suite Word, Works and Excel. Five of the 10 bulletins are rate...

Inside Patch Tuesday: MS patches IIS WebDav, PWN2OWN flaws

Microsoft released 10 security bulletins today. Six of the bulletins impact the Windows operating system, while one applies to the Internet Explorer browser and three affects Microsoft Office Word, Excel, Works. Some interesting notes for today: 1. Microsoft has patched the IIS WebDav 0-day. This...

Microsoft IIS Anonymous HTTP Request Authentication Bypass (MS09-020; CVE-2009-1122)

Web Distributed Authoring and Versioning WebDAV is a set of extensions for HTTP that allow clients to publish, lock, and manage resources on the Web. An elevation of privilege vulnerability has been reported in the Microsoft Windows WebDAV extension for IIS. The vulnerability is due to an error i...