Incorrect setup of external storage - ownCloud

The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups. The storage class is setup without any setup information, leading t...

Server: Incorrect setup of external storage

The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups. The storage class is setup without any setup information, leading t...

Microsoft Windows RDP Driver Information Leakage Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. An information leakage vulnerability exists in the Volume Manager Driver for Microsoft Windows, which originates when a USB disk mounted by the program using the Remote Desktop Protocol RDP is not...

Server: Stored XSS in "activity" application

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

Stored XSS in "activity" application - ownCloud

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

Mounted Dropbox storage allows "Dropbox.com" to access any file - ownCloud

A bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted. This was caused by a feature of PHP which has been turned off per default as of PHP 5.6.0 in t...

Local denial of service vulnerability in nubia z7 phones

An unprotected broadcast receiver exists in the built-in application cn.nubia.factory on the ZTE nubia z7 series cell phone system cn.nubia.factory.service.FactoryResetReciver, a local malicious does not require any Android privileges to send malicious broadcasts to this broadcast receiver, which...

CVE-2014-5341

The CVE-2014-5341 issue affects the ownCloud Server SFTP external storage driver (files_external) prior to version 6.0.5. The root cause is improper RSA host key validation after login, enabling potential information disclosure via network sniffing (MITM-like exposure). Exploitation details are s...

Server: Insufficient RSA Host Key validation in files_external (SFTP driver)

The SFTP external storage driver was verifying the RSA Host Key after logging in. This allows for a man-in-the-middle MITM attack even if the host key is already known and can be validated. Basically, at the point where the host key was validated, the secret has already been given away. It should...

ownCloud Multiple Vulnerabilities-04 (Jul 2014)

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if description...

CVE-2014-3835

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

CVE-2014-3835

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

CVE-2014-3835

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

CVE-2014-3835

The CVE-2014-3835 entry concerns ownCloud Server where the files_external application does not properly check user permissions. Affected are ownCloud Server < 5.0.16 and

The ForzeArmate application安全绕过任意Javascript代码执行漏洞

CVE ID:CVE-2014-1885 The ForzeArmate application是一款基于安卓的应用。 当使用Adobe PhoneGap 2.9.0或之前版本时The ForzeArmate application存在安全漏洞，允许远程攻击者控制任意某一Google联合广告域，来执行任意JavaScript代码，获取外部存储资源。 0 The ForzeArmate application for Android 目前没有详细解决方案提供：...

CVE-2014-1885

The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain...

CVE-2014-1886

The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."...

Code injection

The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."...

Code injection

The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain...

CVE-2014-1886

The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."...