CVE-2014-9047

CVE-2014-9047 affects ownCloud 6.x before 6.0.6 and 7.x before 7.0.3. The vulnerability is a local file disclosure via the preview system, enabling reading arbitrary files through unknown vectors. Multiple connected sources (NVD entry and ownCloud security advisory) confirm the affected versions ...

CVE-2014-9046

The OCUtil::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol...

CVE-2014-9048

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API...

CVE-2014-9045

The FTP backend in userexternal in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password...

CVE-2014-9042

Cross-site scripting XSS vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this c...

CVE-2014-9049

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method...

CVE-2014-5341

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-9047

Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via unknown vectors...

CVE-2014-9048

The CVE-2014-9048 entry concerns ownCloud Server’s documents application, where the vulnerability arises from missing access control in the API. Affected versions are ownCloud Server < 6.0.6 (i.e., 6.x prior to 6.0.6) and

CVE-2014-9042

CVE-2014-9042 is an XSS in the import functionality of the ownCloud bookmarks app, affecting versions prior to 5.0.18, 6.x prior to 6.0.6, and 7.x prior to 7.0.3. The vulnerability allows remote authenticated users to inject arbitrary script/HTML by importing a link with an unspecified protocol. ...

CVE-2014-9043

CVE-2014-9043 affects ownCloud’s user_ldap backend: a null byte in the password with a valid username enables an unauthenticated bind, bypassing authentication. Affected are ownCloud releases prior to 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3. Multiple sources (SUSE/Mandriva advisories and C...

CVE-2014-5341

The CVE-2014-5341 issue affects the ownCloud Server SFTP external storage driver (files_external) prior to version 6.0.5. The root cause is improper RSA host key validation after login, enabling potential information disclosure via network sniffing (MITM-like exposure). Exploitation details are s...

CVE-2014-9049

The CVE-2014-9049 entry concerns ownCloud Server’s Documents application. Affected are ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3. The root issue is a legacy debugging/API method that allowed remote authenticated users to obtain all valid session IDs, enabling access to resources tied ...

CVE-2014-9046

The CVE-2014-9046 case affects ownCloud Server: OC_Util::getUrlContent() can be abused to read arbitrary local files via file:// redirects in affected releases (ownCloud Server < 5.0.18, 6.x < 6.0.6, 7.x

CVE-2014-9045

Summary: CVE-2014-9045 affects the ownCloud Server FTP backend in the external user_External backend. The flaw arises because the FTP backend did not URL-encode credentials, allowing a remote attacker to bypass authentication with a crafted password. Affected versions (per sources): ownCloud Serv...

CVE-2014-9043

The userldap aka LDAP user and group backend application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind...

Stored XSS in "bookmarks" application - ownCloud

Due to not sanitising all user provided input, the "bookmarks" application shipped with the below mentioned ownCloud versions is vulnerable to a stored Cross-site scripting attack. The "bookmarks" application is disabled by default. Abusing this vulnerability requires the user to import a malicio...

CSRF in "bookmarks" application - ownCloud

Due to not verifying the CSRF token on the import functionality of the "bookmarks" application, it was vulnerable against CSRF attacks. The "bookmarks" application is disabled by default. An unauthenticated attacker could have used this to import bookmarks into the "bookmarks" application if the...

Local file disclosure due to the preview system - ownCloud

ownCloud includes a preview system which generates the small thumbnails shown in the file list of the web interface. This functionality can be controlled with the enablepreviews switch in config.php and is enabled by default. Multiple unspecified vulnerabilities have been found within the preview...

ACLs not properly enforced in "documents" application - ownCloud

The "documents" application is a collaborative web-based online editor for ODT files. Using this application you can easily share and collaborate on office documents. This application uses strong and very long random "Session IDs" to limit access to specific resources. Knowledge of this ID allows...