1677 matches found
Cross site scripting
A cross-site scripting XSS issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project Authn users, using the users import functionality Admin only, and changing the login text in t...
CVE-2020-26517
CVE-2020-26517 affects Intland codeBeamer ALM, versions 10.x through 10.1.SP4. The issue is a cross-site scripting (XSS) vulnerability that can be exploited via: (1) WebDAV file uploads to a project by authenticated users, (2) the users import functionality by admin users, and (3) modifying the l...
PT-2021-11243 · Intland · Codebeamer Alm
Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 10.x through 10.1.SP4 Description: A cross-site scripting XSS issue was discovered. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project, using the users...
Nextcloud: public webdav endpoint not bruteforce protected
Again related to https://hackerone.com/reports/1173684 I am having some trouble finding the code. However if you do curl -u "RANDOM1:RANDOM2" -X PROPFIND https://server/public.php/webdav And then check your ocbruteforceattempts table. You'll see there is no entry registered. Impact Low just like ...
Nextcloud: index.php/apps/files_sharing/shareinfo endpoint is not properly protected
When federated shares between two Nextclouds are created they do not use standard webdav to communciate. But to obtain the filelist they seem to use the SERVER/index.php/apps/filessharing/shareinfo endpoint. Unlike the other endpoint for tokens like public link shares. There is no brute force...
The vulnerability of the Yaws WebDAV server implementation lies in the improper restriction of XML links to external objects. This allows attackers to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the Yaws WebDAV server implementation is related to XXE injections. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...
AfterLogic 多个安全漏洞（CVE-2021-26292 CVE-2021-26293 CVE-2021-26294）
CVE-2021-26292 - Public Full Path Disclosure on AfterLogic Aurora & WebMail Pro WebDAV EndPoint The severity of the issue: Medium Complexity: Easy Affected Products: AfterLogic Aurora, AfterLogic WebMail PRO Authentication: Not required Attacks: Full Path Disclosure Resources : -...
Microsoft Windows WebDAV Client Privilege Escalation (CVE-2016-0051)
A privilege escalation vulnerability exists in Microsoft Windows WebDAV Client. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...
[SECURITY] [DSA 4773-1] yaws security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4773-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 16, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4773-1] yaws security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4773-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 16, 2020 https://www.debian.org/security/faq -...
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
DEBIAN-CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
Design/Logic Flaw
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
UBUNTU-CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
PT-2020-5795 · Yaws +1 · Yaws Webserver +1
Name of the Vulnerable Software and Affected Versions: Yaws web server versions 1.81 through 2.0.7 Description: The issue is related to the implementation of WebDAV in the Yaws web server, which is vulnerable to XXE injection. This could allow a remote attacker to access confidential data,...
Security Bulletin: Vulnerability in InstallShield affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2016-2542)
Summary An InstallShield vulnerability was disclosed by Flexera. InstallShield is used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera...
Pwndrop - Self-Deployable File Hosting Service For Red Teamers, Allowing To Easily Upload And Share Payloads Over HTTP And WebDAV
pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...