CVE-2021-35948

Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie...

CVE-2021-35948

CVE-2021-35948 affects ownCloud Server prior to 10.8.0. The vulnerability is a session-fixation issue where an attacker can force a target client to use a controlled cookie, allowing bypass of password protection on public links. Affected component: ownCloud Server public links/session handling. ...

CVE-2021-35949

The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share...

CVE-2021-35949

CVE-2021-35949 affects the shareinfo controller in ownCloud Server prior to 10.8.0, enabling an attacker to bypass upload-only share permission checks and enumerate share metadata via a network-based, low-complexity path with no authentication. A fix is available in 10.8.0 and later; upgrading to...

CVE-2021-35947

The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...

Owncloud ownCloud 权限许可和访问控制问题漏洞

Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. The ownCloud Server suffers from a Privilege License and Access Control Issue vulnerability that stems from the ability of a federated share recipient to increase privileges, which can lead to bypassing...

ownCloud 安全漏洞

ownCloud is a personal cloud storage solution from US-based ownCloud. A security vulnerability exists in ownCloud Server, which can be exploited by an attacker to gain unauthorized access to sensitive system information...

CVE-2020-36252

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number...

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36251

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...

Design/Logic Flaw

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36249

The CVE-2020-36249 case concerns OwnCloud File Firewall (pre-2.8.0) failing to enforce file-type restrictions on public shares. Affected product is ownCloud Server’s File Firewall component; the root cause is described as improper enforcement of shared-file type restrictions. Public shares could ...

CVE-2020-36251

Summary (supported by provided documents): CVE-2020-36251 affects OwnCloud Server and concerns a permissions/access control issue in group shares. Specifically, as described in the CVE, an attacker who already has non-administrative access to a group share can remove everyone else’s access to tha...

Bypassing File Firewall (oC-SA-2020-002)

Platform: ownCloud Server Versions: n/a Date: 8/3/2020 Risk: Low CVSS v3 Base Score: 1.6 CVSS v3 Vector: AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N CWE ID: CWE-791 CWE Name: Incomplete Filtering of Special Elements...

Deleting received group share for whole group

Platform: ownCloud Server Versions: 10.2.0 Date: 2/28/2020 Risk: Low CVSS v3 Base Score: 3.5 CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CWE ID: 385 CWE Name: Improper Privilege Management...

Code injection

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ at sign character in unspecified POS...

CVE-2015-4715

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ at sign character in unspecified POS...

CVE-2015-4715

The CVE-2015-4715 entry affects ownCloud Server (Dropbox storage integration) via the Dropbox-PHP OAuth/Curl.php fetch function when an external Dropbox storage is mounted. Affected versions: ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4. The vulnerability allows remote adm...

CVE-2014-2052

Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...