CVE-2014-2047

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

Design/Logic Flaw

The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors...

CVE-2013-1939

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ backslash character...

CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-2086

The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file...

Directory traversal

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

UBUNTU-CVE-2013-2043

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendarid parameter...

UBUNTU-CVE-2013-2048

ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands...

Code injection

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendarid parameter...

UBUNTU-CVE-2013-2044

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

UBUNTU-CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2014-2049

The CVE-2014-2049 issue affects ownCloud Server before version 5.0.15 and before 6.0.2, due to insecure default Flash Cross Domain policies. Root cause: insecure cross-domain configuration in Flash policies. Impact: remote attackers could access user files via unspecified vectors. Public advisori...

CVE-2013-2149

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files...

CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2013-1822

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the 1 quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin...

CVE-2013-2044

The CVE-2013-2044 issue affects ownCloud Server prior to version 5.0.6, where the login page (index.php) allows an Open Redirect via the redirect_url parameter. This can enable attackers to redirect users to arbitrary sites and facilitate phishing attacks. The vulnerability is documented in offic...

CVE-2013-1851

CVE-2013-1851 affects ownCloud server via an incomplete blacklist in lib/migrate.php. Affected versions are before 4.0.13 and before 4.5.8 (4.5.x). When user_migrate is enabled, remote authenticated users can import arbitrary files into their own account via unspecified vectors. Root cause is imp...

CVE-2013-2089

CVE-2013-2089 affects ownCloud up to version 5.0.6, where an incomplete blacklist in file upload handling allows authenticated remote users to execute arbitrary PHP code by uploading a crafted file and then requesting it directly from /data. The issue originates from insufficient validation of up...

CVE-2013-2150

CVE-2013-2150 affects ownCloud’s viewer.js (js/viewer.js) across versions prior to 4.5.12 and 5.x prior to 5.0.7, enabling remote XSS via shared-files vectors. Multiple connected advisories corroborate these XSS issues and cite the affected versions and files (viewer.js and core/js/oc-dialogs.js)...