Path traversal

The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...

CVE-2021-35947

The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...

CVE-2021-35948

CVE-2021-35948 affects ownCloud Server prior to 10.8.0. The vulnerability is a session-fixation issue where an attacker can force a target client to use a controlled cookie, allowing bypass of password protection on public links. Affected component: ownCloud Server public links/session handling. ...

CVE-2021-35948

Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie...

CVE-2021-35946

A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions...

CVE-2021-35946

CVE-2021-35946 describes a privilege-escalation flaw in ownCloud Server prior to 10.8: a recipient of a federated share with database access could update permissions and elevate their own privileges. Public details in the provided sources confirm the affected product/version (ownCloud Server befo...

CVE-2021-35949

The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share...

CVE-2021-35949

CVE-2021-35949 affects the shareinfo controller in ownCloud Server prior to 10.8.0, enabling an attacker to bypass upload-only share permission checks and enumerate share metadata via a network-based, low-complexity path with no authentication. A fix is available in 10.8.0 and later; upgrading to...

CVE-2021-35947

CVE-2021-35947 affects the ownCloud server prior to 10.8.0. The flaw allows a remote attacker to reveal the internal path and the username of a public share by inserting invalid characters in the share URL. The issue is tied to the public share controller; exploitation details and a confirmed aff...

CVE-2021-35947

The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...

ownCloud < 10.8 Multiple Vulnerabilities

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

Owncloud ownCloud 授权问题漏洞

Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. An authorization issue vulnerability exists in ownCloud Server, which stems from a session cookie not being reset after authenticating against a public link. An attacker could exploit this vulnerability to...

ownCloud 信息泄露漏洞

Owncloud ownCloud is a personal cloud storage solution from US-based ownCloud Owncloud. An information disclosure vulnerability exists in ownCloud Server that stems from a generated error message containing sensitive information. An attacker could trigger the error by appending certain characters...

ownCloud 安全漏洞

Owncloud ownCloud is a personal cloud storage solution from the American company ownCloud Owncloud. A security vulnerability exists in ownCloud Server that stems from the ability to bypass permission checks for file deletion by using the shareinfo API. The vulnerability can be exploited by an...

Owncloud ownCloud 权限许可和访问控制问题漏洞

Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. The ownCloud Server suffers from a Privilege License and Access Control Issue vulnerability that stems from the ability of a federated share recipient to increase privileges, which can lead to bypassing...

Shareinfo url doesn't verify file drop permissions - ownCloud

The permission check for a file drop upload only share could be circumvented by using the shareinfo API. This allowed to see from the files in the filedrop but didn’t allow downloads...

Session fixation on public links - ownCloud

The session cookies were not reset after authenticating for public links...

Federated share recipient can increase permissions - ownCloud

The receiver of a federated share could update the permissions granted to the receivers of the share...

files_antivirus 操作系统命令注入漏洞

filesantivirus is a ClamAV-based ownCloud antivirus application. filesantivirus before 1.0.0 suffers from an operating system command injection vulnerability that allows remote users to execute arbitrary shell commands on the target system...

files_antivirus 代码问题漏洞

filesantivirus is a ClamAV-based ownCloud antivirus application. A security vulnerability exists in filesantivirus, which allows remote attackers to exploit the vulnerability to compromise a target system. The affected products and versions are as follows:files antivirus:Prior to 1.0.0...