ownCloud: bug reporting template encourages users to paste config file with passwords

The dangerous bug reporting template ============================= The github bug reporting template for owncloud's server and some apps contains this: The content of config/config.php: If you have access to your command line run e.g.: sudo -u www-data php occ config:list system from within your...

Nextcloud: bug reporting template encourages users to paste config file with passwords

The dangerous bug reporting template ============================= The github bug reporting template for nextcloud's server and some apps contains this: The content of config/config.php: If you have access to your command line run e.g.: sudo -u www-data php occ config:list system from within your...

Bypass received read-only share permissions using read-write reshare - ownCloud

User can upload and modify the link share contents even though the original sharer has only read-only access. Affected Software ownCloud Server 9.1.2 CVE-2016-???? core/c7c1b61e10514fe4d8efbaf1156501dd795e7ac1 ownCloud Server 9.0.6 CVE-2016-???? core/65af3785ab5e1d780598874b3553c93767447f1f Actio...

ownCloud: Stored xss

visit this https://conference.owncloud.org then go to edit profile click button which i give in s.jpg then go to Biography and paste this code "prompt1 proof https://conference.owncloud.org/users/949...

OwnCloud Cross-Site Scripting Vulnerability (CNVD-2017-00095)

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany. OwnCloud suffers from a cross-site scripting vulnerability that can be exploited by an attacker to steal cookie-based authentication credentials...

OwnCloud 'dav' app content spoofing vulnerability

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany. A content spoofing vulnerability exists in the OwnCloud 'dav' app. A misrepresentation of potential information is caused by displaying an anomalous message that contains partial user-controllable input at t...

OwnCloud HTML Injection Vulnerability

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany. OwnCloud suffers from an HTML injection vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the affected application...

OwnCloud 'file' app content spoofing vulnerability

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany. A content spoofing vulnerability exists in the OwnCloud 'file' app due to the location bar in the file app failing to validate passed parameters, allowing an attacker to spoof a link to a fake directory...

OwnCloud Authentication Bypass Vulnerability

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany. An authentication bypass vulnerability exists in OwnCloud, which can be exploited by an attacker to perform unauthorized operations...

Content-Spoofing in "dav" app - ownCloud

The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information. Affected Software ownCloud Server 9.1.2 CVE-2016-???? core/96b8afe48570bc70088ccd8f897e9d71997d336e ownCloud Server 9.0.6 CVE-2016-????...

Content-Spoofing in "files" app - ownCloud

The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user. Affected Software ownCloud Server 9.1.2 CVE-2016-????...

Reflected XSS in Gallery application - ownCloud

The gallery app was not properly sanitizing exception messages from the ownCloud server. Due to an endpoint where an attacker could influence the error message this lead to a reflected Cross-Site-Scripting vulnerability. Affected Software ownCloud Server 9.1.2 CVE-2016-????...

Stored XSS in CardDAV image export - ownCloud

The CardDAV image export functionality as implemented in ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack. Note:ownCloud employs a very strict Content Security...

SMB User Authentication Bypass - ownCloud

ownCloud includes an optional and not by default enabled SMB authentication component that allows to authenticate users against an SMB server. This backend is implemented in a way that it tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not...

Server: Reflected XSS in Gallery application

The gallery app was not properly sanitizing exception messages from the ownCloud server. Due to an endpoint where an attacker could influence the error message this lead to a reflected Cross-Site-Scripting vulnerability. For more information please consult the official advisory. This advisory is...

Server: Stored XSS in CardDAV image export

The CardDAV image export functionality as implemented in ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack. Note:ownCloud employs a very strict Content Security...

Server: SMB User Authentication Bypass

ownCloud includes an optional and not by default enabled SMB authentication component that allows to authenticate users against an SMB server. This backend is implemented in a way that it tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not...

OwnCloud/NextCloud Cross-Site Scripting Vulnerability

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany.Nextcloud is an open source self-hosted file synchronization and sharing communication application platform.OwnCloud Server and Nextcloud Server are both a server version of one of them. A cross-site scriptin...

ownCloud 10.0.1 Cross Site Scripting

Dear Community By comparing the advisory of NextCloud and OwnCloud I figured out that OwnCloud has multiple not patched vulnerabilities. You can see list here it seems all patches missing from latest Nextcloud 10.0.1 release in OwnCloud: https://nextcloud.com/security/advisories. This seems to...

ownCloud 'share.js' Gallery Application XSS Vulnerability - Windows

ownCloud is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"...