ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

owncloud-exploits

针对CVE-2023-49105的ownCloud漏洞利用 有关漏洞详情，请参考文章。 仅供教育目的使用。...

CVE-2017-10797

CVE-2017-10797 CVE-2017-10797- OwnCloud Server 8.1-10.0 中的用户枚举...

ownCloud_RCE_CVE-2013-0303

此存储库没有 README。...

OwnCloud-CVE-2023-49103

构建容器的方法： 1: 下载文件夹，解压并构建容器。 2: docker build -t cve-2023-49103 ./ 3: docker run --name cve-2023-49103 -p 80:80 -p 443:443 cve-2023-49103...

CVE-2023-49103

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我们要求安全归还所有被恐怖组织哈马斯劫持为人质的公民。在所有被劫持人质获释并安全回家之前，我们不会停止努力。你也可以帮助他们回家。https://stories.bringthemhomenow.net/ CVE-2023-49103 漏洞利用 背景 ownCloud 是一个面向企业环境设计的文件共享平台。2023 年 11 月 21 日，ownCloud 披露了 CVE-2023-49103，这是一个影响 ownCloud 的无需认证的信息泄露漏洞，当存在名为 “Graph...

CVE-2024-37010

CVE-2024-37010 针对CVE-2024-37010的利用：访问其他用户的外部存储及横向移动： https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0753/ https://owncloud.com/security-advisories/insecure-direct-object-reference-in-external-storage 简介 Owncloud 将服务器转变为一个用于存储文件的云服务，类似于 Google Drive。这使得例如公司能够为员工提供云服务，而无需由第三方进行管理。...

CVE-2024-50657

CVE-2024-50657:在 Owncloud apk 中存在的访问控制缺陷 Owncloud android apk 版本 4.4.1 中的一个问题允许物理邻近的攻击者通过 PassCodeViewModel 类（特别是 checkPassCodeIsValid 方法）提升权限。 漏洞类型 不正确的访问控制 产品厂商 Owncloud 受影响产品代码库 Owncloud android apk - 4.4.1 受影响组件 com.owncloud.android.presentation.security.passcode.PassCodeViewModel 利用方法...

cve-2026-23989-opencloud-lab

CVE-2026-23989 — Omisión del alcance de enlaces públicos en OpenCloud / ownCloud Infinite Scale Un laboratorio autónomo de un solo comando que reproduce CVE-2026-23989 y demuestra que está corregido, utilizando las imágenes oficiales de Docker del proyecto upstream. Un enlace de uso público que s...

CVE-2026-84282

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12) developed by Ascensio System SIA . The /apps/onlyoffice/ajax/settings/address endpoint fails to sufficiently validate user-supplied Document Server URLs before initiating outboun...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

PT-2026-87103

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282: Undefined Security Weakness

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

Exploit for Incorrect Authorization in Heinlein Opencloud_Reva

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale public-li...

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities KEV catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in...