Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 unspecified parameters to apps/calendar/ajax/event/new.php or 2 url parameter to apps/bookmarks/ajax/addBookmark.php...

PT-2019-6838

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.0.10 through 4.5.5 ownCloud versions prior to 4.0.10 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the unspecified parameters to...

CVE-2013-0203: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 unspecified parameters to apps/calendar/ajax/event/new.php or 2 url parameter to apps/bookmarks/ajax/addBookmark.php...

CVE-2015-6670: Undefined Security Weakness

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php...

PT-2015-2580

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 7.0.8 ownCloud Server versions 8.0.x prior to 8.0.6 ownCloud Server versions 8.1.x prior to 8.1.1 Description The issue is related to improper ownership checking of calendars, allowing remote authenticated use...

Server: Calendar export: Authorization Bypass Through User-Controlled Key

Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calid" GET parameter to export.php in /apps/calendar/ For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

PT-2014-2449

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 4.5.7 Description The issue allows remote authenticated users to read arbitrary calendars due to improper ownership checking of calendars. This can be achieved via the calid parameter to the...

CVE-2013-0301

Cross-site request forgery CSRF vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter...

CVE-2013-0299

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the timezone for the user via the lat and lng parameters to...

CVE-2013-0300

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary 2 Google Drive or 3 Dropbox...

CVE-2013-0301: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter...

PT-2014-2536

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.11 ownCloud versions 5.x prior to 5.0.6 Description The issue allows remote authenticated users to download arbitrary calendars due to improper ownership checking of a calendar. This is achieved via the calendar ...

PT-2014-2444

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description The issue allows remote attackers to hijack user authentication for various requests. This includes changing the timezone via the lat and lng parameters to...

CVE-2013-0299: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the timezone for the user via the lat and lng parameters to...

PT-2014-2446

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 Description A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for requests that change the timezone via the timezone parameter in the...

PT-2014-2445

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.6 Description The issue allows remote attackers to hijack the authentication of users for various requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities. Specifically...

CVE-2012-4397

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...

CVE-2012-4396

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 file names to apps/userldap/settings.php; 2 url or 3 title parameter to apps/bookmarks/ajax/editBookmark.php; 4 tag or 5 page parameter to...

PT-2012-5371

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.1 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can occur through the calendar display name in certain PHP fil...

CVE-2012-4397: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...