CVE-2013-0298

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted iCalendar file to the calendar application, the 2 dir or 3 file parameter to apps/filespdfviewer/viewer.php, or the 4 mountpoint parameter...

CVE-2013-0297

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 sitename or 2 siteurl parameter to apps/external/ajax/setsites.php...

CVE-2013-0307

Cross-site scripting XSS vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter...

CVE-2013-0297

CVE-2013-0297 concerns multiple XSS flaws in ownCloud prior to 4.0.12 and 4.5.x prior to 4.5.7. The vulnerabilities allow remote authenticated administrators to inject arbitrary script/HTML via the site_name or site_url parameters to apps/external/ajax/setsites.php. Connected sources confirm affe...

CVE-2013-0298

OwnCloud 4.5.x is vulnerable to multiple XSS via (1) an iCalendar file in the calendar app, (2) the dir or (3) file parameters to apps/files_pdfviewer/viewer.php, or (4) the mountpoint parameter to /apps/files_external/addMountPoint.php. Root cause: improper handling of untrusted input in these c...

CVE-2013-0307

CVE-2013-0307 is an XSS vulnerability in ownCloud’s settings.php that allows an administrator to inject arbitrary script/HTML via the group input field. It affects ownCloud servers prior to 4.0.12 and prior to 4.5.7 (4.5.x before 4.5.7). The Root Cause, as documented, is a DOM-based XSS flaw in t...

PT-2014-2535

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.15 ownCloud versions 4.5.x prior to 4.5.11 ownCloud versions 5.0.x prior to 5.0.6 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This is achieved via the url...

PT-2014-2541

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue allows remote authenticated users to execute arbitrary API commands due to improper permission checks. This can be leveraged using CSRF to enable remote attackers to execute arbitrary API...

CVE-2014-2047: Improper Authentication

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2014-2049: Undefined Security Weakness

The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors...

CVE-2013-1851: Undefined Security Weakness

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the usermigrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors...

CVE-2013-0298: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted iCalendar file to the calendar application, the 2 dir or 3 file parameter to apps/filespdfviewer/viewer.php, or the 4 mountpoint parameter...

PT-2014-2442

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the site name or site url parameter to t...

PT-2014-2546

Name of the Vulnerable Software and Affected Versions ownCloud versions 5.0.x through 5.0.5 Description The configuration loader in ownCloud allows remote attackers to obtain sensitive information, including CSRF tokens, by reading an unspecified JavaScript file. Recommendations For ownCloud...

PT-2014-2502

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.7 Description The issue allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the quota parameter to "/core/settings/ajax/setquota.php". Additionally,...

CVE-2013-1850: Improper Control of Generation of Code

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

PT-2014-2450

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description A cross-site scripting XSS issue allows remote administrators to inject arbitrary web script or HTML via the group input field parameter in the settings.php...

PT-2014-2444

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description The issue allows remote attackers to hijack user authentication for various requests. This includes changing the timezone via the lat and lng parameters to...

CVE-2013-2085: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-1963: Undefined Security Weakness

The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors...