WebDAV Api Authentication Bypass using Pre-Signed URLs - ownCloud

It is possible to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured which is the default...

PT-2023-7303 · Owncloud · Owncloud

Name of the Vulnerable Software and Affected Versions: ownCloud versions 10.6.0 through 10.13.0 Description: An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the...

ownCloud Security Breach

ownCloud is a personal cloud storage solution from US-based ownCloud, Inc. A security vulnerability exists in ownCloud core versions 10.6.0 through 10.13.0, which can be exploited to bypass WebDAV Api authentication using a pre-signed URL...

ROS-20231019-01

Vulnerability in Nextcloud cloud storage creation and utilization software is related to lack of protection and allows password mining in WebDAV API. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information...

SUSE CVE-2023-39960

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing...

CVE-2023-45686

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

CVE-2023-45686 Arbitrary file write via WebDAV path traversal in Titan MFT and Titan SFTP servers

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

CVE-2023-45686 Arbitrary file write via WebDAV path traversal in Titan MFT and Titan SFTP servers

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

CVE-2023-45686

CVE-2023-45686 affects South River Technologies’ Titan MFT and Titan SFTP servers. The root cause is insufficient path validation in WebDAV handling, enabling an authenticated attacker to perform path traversal and write a file to an arbitrary location on the filesystem (Linux). The issue is post...

Nextcloud Server < 22.2.10.14, 23.x < 23.0.12.9, 24.x < 24.0.12.5, 25.x < 25.0.9, 26.x < 26.0.4 Improper Access Control Vulnerability (GHSA-2hrc-5fgp-c9c9)

Nextcloud Server is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2023-29651 · South River Technologies · Titan Mft +1

Name of the Vulnerable Software and Affected Versions: South River Technologies' Titan MFT and Titan SFTP servers affected versions not specified Description: The issue is related to insufficient path validation when writing a file via WebDAV, allowing an authenticated attacker to write a file to...

Code injection

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing...

CVE-2023-39960 Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing...

CVE-2023-39960

Technical details for CVE-2023-39960 are not publicly available in the provided documents; monitor for updates.

CVE-2023-39960 Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing...

CVE-2023-39960 Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing...

Improper restriction of excessive authentication attempts on WebDAV endpoint

None...

Cybercriminals Using New ASMCrypt Malware Loader to Fly Under the Radar

Threat actors are selling a new crypter and loader called ASMCrypt, which has been described as an "evolved version" of another loader malware known as DoubleFinger. "The idea behind this type of malware is to load the final payload without the loading process or the payload itself being detected...

FreeBSD : py-WsgiDAV -- XSS vulnerability (1a15b928-5011-4953-8133-d49e24902fe1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1a15b928-5011-4953-8133-d49e24902fe1 advisory. - WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library...

PT-2023-7493 · Asus · Asus Rt-Ax92U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AX92U affected versions not specified Description: This issue allows network-adjacent attackers to disclose sensitive information on affected ASUS RT-AX92U routers. The flaw exists within the mod webdav.so module, where the process do...