ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

owncloud-exploits

Эксплойты ownCloud для CVE-2023-49105 Подробности об уязвимости см. в статье. Предоставлено только в образовательных целях...

CVE-2017-10797

CVE-2017-10797 CVE-2017-10797- Énumération d'utilisateurs dans OwnCloud Server 8.1-10.0...

ownCloud_RCE_CVE-2013-0303

Ce depot n’a pas de fichier README...

OwnCloud-CVE-2023-49103

Чтобы собрать контейнер, выполните: 1: Скачайте папку, распакуйте и соберите контейнер. 2: docker build -t cve-2023-49103 ./ 3: docker run --name cve-2023-49103 -p 80:80 -p 443:443 cve-2023-49103...

CVE-2023-49103

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Мы требуем безопасного возвращения всех граждан, взятых в заложники террористической группировкой ХАМАС. Мы не успокоимся, пока каждый заложник не будет освобождён и не вернётся домой в безопасности. Вы можете помочь вернуть их...

CVE-2024-37010

CVE-2024-37010 Эксплойт для CVE-2024-37010: доступ к внешнему хранилищу другого пользователя и латеральное перемещение: https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0753/ https://owncloud.com/security-advisories/insecure-direct-object-reference-in-external-storage Введение Owncloud превращае...

CVE-2024-50657

CVE-2024-50657:Contrôle d'accès incorrect sur l'APK Owncloud Un problème dans l'APK Android Owncloud v.4.4.1 permet à un attaquant physiquement proche d'élever ses privilèges via la classe PassCodeViewModel, plus précisément dans la méthode checkPassCodeIsValid. Type de vulnérabilité Contrôle...

cve-2026-23989-opencloud-lab

CVE-2026-23989 — обход области действия публичной ссылки OpenCloud / ownCloud Infinite Scale Автономная лаборатория из одной команды, которая воспроизводит CVE-2026-23989 и доказывает, что уязвимость исправлена, используя официальные образы Docker из апстрима. Публичная ссылка для общего доступа,...

CVE-2026-84282

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12) developed by Ascensio System SIA . The /apps/onlyoffice/ajax/settings/address endpoint fails to sufficiently validate user-supplied Document Server URLs before initiating outboun...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

PT-2026-87103

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282: Undefined Security Weakness

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

Exploit for Incorrect Authorization in Heinlein Opencloud_Reva

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale public-li...

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities KEV catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in...