CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2023-491059.8/CRITICALEPSS 43.2%CISA KEV

2023-11-21

ownCloud Core WebDAV API Authentication Bypass via Pre-Signed URLs (CVE-2023-49105)

[Affected Scope] ownCloud Core versions from 10.6.0 up to (but excluding) 10.13.1 are affected.

[Impact] Unauthenticated attackers can access, modify, or delete any file if they know the victim's username and the victim has no signing-key configured.

[Mitigation] Immediately upgrade ownCloud Core to version 10.13.1 or higher, and enforce signing-key configurations as a temporary workaround.

authentication-bypass webdav pre-signed-url CWE-287

Full Advisory & Mitigation

CVE-2017-72699.8/CRITICALEPSS 99.8%CISA KEV

2017-03-27

Microsoft IIS 6.0 WebDAV ScStoragePathFromUrl Buffer Overflow Remote Code Execution (CVE-2017-7269)

[Affected Scope] Microsoft Internet Information Services (IIS) 6.0 with WebDAV service enabled on Windows Server 2003 R2.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges and fully compromise the host by sending a specially crafted HTTP PROPFIND request.

[Mitigation] Since Windows Server 2003 is End-of-Life (EoL), immediately migrate to a supported OS version or disable the IIS WebDAV service.

cve-2017-7269 iis-6.0 webdav buffer-overflow rce cwe-120

Full Advisory & Mitigation