CVE-2013-2039: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files via unspecified vectors...

CVE-2013-0297: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 sitename or 2 siteurl parameter to apps/external/ajax/setsites.php...

PT-2014-2446

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 Description A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for requests that change the timezone via the timezone parameter in the...

PT-2014-4451

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.15 ownCloud versions 6.x prior to 6.0.2 Description The issue allows remote attackers to access user files due to the default Flash Cross Domain policies. Recommendations For ownCloud versions prior to 5.0.15,...

PT-2014-2522

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.10 ownCloud versions 5.x prior to 5.0.5 Description The contacts application in ownCloud does not properly check the ownership of contacts. This allows remote authenticated users to download arbitrary contacts vi...

PT-2014-2545

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.6 Description The issue allows remote authenticated users to access arbitrary files. This is achieved by utilizing a .. dot dot in the dir parameter of the apps/files trashbin/index.php file, which enables...

CVE-2013-2048: Undefined Security Weakness

ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands...

PT-2014-2548

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file and then accessing it via a direct request to the file in /data. Recommendations For versions...

CVE-2013-2086: Exposure of Sensitive Information to an Unauthorized Actor

The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file...

CVE-2013-0299: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the timezone for the user via the lat and lng parameters to...

CVE-2013-2150: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files...

PT-2014-2505

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.13 ownCloud versions 4.5.x prior to 4.5.8 Description The issue allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors when the user migrate application is...

CVE-2013-2044: Improper Input Validation

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

PT-2014-2532

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.15 ownCloud versions 4.5.x through 4.5.11 ownCloud versions 5.x through 5.0.6 Description The issue allows remote authenticated users to access arbitrary files via unspecified vectors due to a directory traversal...

PT-2014-2504

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.13 ownCloud versions 4.5.x prior to 4.5.8 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file due to multiple incomplete blacklist vulnerabilities i...

PT-2014-2540

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue concerns the login page, specifically the password parameter, where the autocomplete setting is not disabled. This makes it easier for physically proximate attackers to guess the password...

PT-2014-2534

Name of the Vulnerable Software and Affected Versions ownCloud versions 5.0.0 through 5.0.5 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the tag parameter to "apps/bookmarks/ajax/addBookmark.php" or the dir parameter to...

CVE-2013-0301: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter...

CVE-2013-2089: Undefined Security Weakness

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data...

CVE-2013-2149: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files...