1685 matches found
CVE-2025-33053 Internet Shortcut Files Remote Code Execution Vulnerability
...
CVE-2025-33053 Internet Shortcut Files Remote Code Execution Vulnerability
...
Patch Tuesday - June 2025
Microsoft is addressing 67 vulnerabilities this June 2025 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation for just one of the vulnerabilities published today, and that is reflected in CISA KEV. Separately, Microsoft is aware of existing public disclosure for one other freshly...
CVE-2025-33053
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. Recent assessments: cbeek-r7 at June 12, 2025 6:57am UTC reported: CVE-2025-33053 is a zero-day vulnerability that enables remote code execution RCE through abuse of ho...
Microsoft WebDAV 安全漏洞
Microsoft WebDAV is an HTTP protocol-based extension for file management and collaborative editing over the Internet from Microsoft USA. A security vulnerability exists in Microsoft WebDAV. An attacker exploiting this vulnerability could execute code. The following products and versions are...
VulnCheck KEV: CVE-2025-33053
Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files...
CVE-2024-25660
The WebDAV service in Infinera TNMS Transcend Network Management System 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges...
CVE-2024-29640
An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the actionqueryqrcode component...
CVE-2024-1192
A vulnerability was found in South River WebDrive 18.00.5057. It has been declared as problematic. This vulnerability affects unknown code of the component New Secure WebDAV. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been...
CVE-2023-32319
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issu...
CVE-2020-26517
A cross-site scripting XSS issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project Authn users, using the users import functionality Admin only, and changing the login text in t...
CVE-2013-3694
BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...
CVE-2019-19033
Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account, by using any username and the hardcoded dev password...
CVE-2018-20000
Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...
CVE-2018-1000831
K9Mail version = v5.600 contains a XML External Entity XXE vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDA...
CVE-2018-20870
The WebDAV transport feature in cPanel before 76.0.8 enables debug logging SEC-467...
CVE-2012-2087
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface...
CVE-2011-3463
WebDAV Sharing in Apple Mac OS X 10.7.x before 10.7.3 does not properly perform authentication, which allows local users to gain privileges by leveraging access to 1 the server or 2 a bound directory...
CVE-2004-2577
The aclcheck function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts...