Debian: Security Advisory (DSA-3298-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Internet Explorer ShowSaveFileDialog DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Internet Explorer is a web browser from Microsoft. Microsoft Internet Explorer suffers from an arbitrary code execution vulnerability in its implementation, which can be exploited by an attacker who places a file in a remotely accessible UNC or WebDAV share location to execute arbitrary...

Denial of Service attack through vulnerable Xerces-J library

quote There is WebDav endpoint that is accessible via following URL - https://pwnie.ninja/confluence/plugins/servlet/confluence/default . It is possible to pass XML as data for PROPFIND request. Following python code will generate XML with long pseudo-attribute name that exploits CVE-2013-4002...

Denial of Service attack through vulnerable Xerces-J library

quote There is WebDav endpoint that is accessible via following URL - https://pwnie.ninja/confluence/plugins/servlet/confluence/default . It is possible to pass XML as data for PROPFIND request. Following python code will generate XML with long pseudo-attribute name that exploits CVE-2013-4002...

MGASA-2015-0242 Updated jackrabbit packages fix CVE-2015-1833

Updated jackrabbit packages fix security vulnerability: In Apache Jackrabbit before 2.4.6, When processing a WebDAV request body containing XML, the XML parser can be instructed to read content from network resources accessible to the host, identified by URI schemes such as "https" or "file"...

Updated jackrabbit packages fix CVE-2015-1833

Updated jackrabbit packages fix security vulnerability: In Apache Jackrabbit before 2.4.6, When processing a WebDAV request body containing XML, the XML parser can be instructed to read content from network resources accessible to the host, identified by URI schemes such as "https" or "file"...

CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability)

Dear readers, we just fixed a recently reported vulnerability in Apache Jackrabbit's WebDAV module; see - the attached CVE report - patches for all currently maintained Jackrabbit branches We just released Jackrabbit 2.10.1 see below and we'll get to the other branches shortly. Check the CVE for...

Apache Jackrabbit XXE

XXE via WebDAV request...

WebDrive 12.2 (B4172) - Buffer Overflow (PoC)

WebDrive 12.2 B4172 - Buffer Overflow PoC Document Title: =============== WebDrive 12.2 B4172 - Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1500 Release Date: ============= 2015-06-01 Vulnerability Laboratory ID VL-ID:...

http-webdav-scan NSE Script

A script to detect WebDAV installations. Uses the OPTIONS and PROPFIND methods. The script sends an OPTIONS request which lists the dav type, server type, date and allowed methods. It then sends a PROPFIND request and tries to fetch exposed directories and internal ip addresses by doing pattern...

WebDrive 12.2 (Build # 4172) - Buffer OverFlow PoC

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title:WebDrive Buffer OverFlow PoC Author: metacom Vendor Homepage: http://www.webdrive.com/products/webdrive/ Software Link: https://www.webdrive.com/products/webdrive/download/ Version: 12.2 build 4172 32 bit Date...

WebDrive 12.2 Buffer Overflow

Document Title: =============== WebDrive 12.2 B4172 - Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1500 Release Date: ============= 2015-06-01 Vulnerability Laboratory ID VL-ID: ==================================== 1500...

WebDrive 12.2 (Build #4172) - Remote Buffer Overflow

WebDrive 12.2 Build 4172 - Remote Buffer Overflow !/usr/bin/python Exploit Title:WebDrive Buffer OverFlow PoC Author: metacom Vendor Homepage: http://www.webdrive.com/products/webdrive/ Software Link: https://www.webdrive.com/products/webdrive/download/ Version: 12.2 build 4172 32 bit Date found:...

WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability

Document Title: =============== WebDrive 12.2 B4172 - Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1500 Release Date: ============= 2015-06-01 Vulnerability Laboratory ID VL-ID: ==================================== 1500...

WebDrive 12.2 (Build #4172) - Remote Buffer Overflow

!/usr/bin/python Exploit Title:WebDrive Buffer OverFlow PoC Author: metacom Vendor Homepage: http://www.webdrive.com/products/webdrive/ Software Link: https://www.webdrive.com/products/webdrive/download/ Version: 12.2 build 4172 32 bit Date found: 31.05.2015 Date published: 31.05.2015 Platform:...

WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability

Document Title: =============== WebDrive 12.2 B4172 - Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1500 Release Date: ============= 2015-06-01 Vulnerability Laboratory ID VL-ID: ==================================== 1500...

WebDrive 12.2 Buffer Overflow

!/usr/bin/python Exploit Title:WebDrive Buffer OverFlow PoC Author: metacom Vendor Homepage: http://www.webdrive.com/products/webdrive/ Software Link: https://www.webdrive.com/products/webdrive/download/ Version: 12.2 build 4172 32 bit Date found: 31.05.2015 Date published: 31.05.2015 Platform:...

DEBIAN-CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...