CVE-2013-2149: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files...

CVE-2013-2047: Undefined Security Weakness

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

CVE-2013-0307: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter...

CVE-2013-0300: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary 2 Google Drive or 3 Dropbox...

PT-2014-2443

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.6 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various means, including: - a...

PT-2014-2445

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.6 Description The issue allows remote attackers to hijack the authentication of users for various requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities. Specifically...

PT-2014-2533

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.15 ownCloud versions 4.5.x prior to 4.5.11 ownCloud versions 5.0.x prior to 5.0.6 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, which can...

PT-2014-4450

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 6.0.2 Description A session fixation issue allows remote attackers to hijack web sessions when PHP is configured to accept session parameters through a GET request. Recommendations For ownCloud versions prior to 6.0....

PT-2014-2537

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect url parameter in the Login Page index.php. Recommendations For...

CVE-2013-2040: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2041: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tag parameter to apps/bookmarks/ajax/addBookmark.php or 2 dir parameter to apps/files/ajax/newfile.php, which is passed to...

CVE-2013-2042: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to 1 apps/bookmarks/ajax/addBookmark.php or 2 apps/bookmarks/ajax/editBookmark.php...

Mandriva Linux Security Advisory : owncloud (MDVSA-2014:055)

Updated owncloud packages fix security vulnerabilities and bugs : Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

ownCloud 'lib/bookmarks.php' SQL Injection Vulnerability

ownCloud is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if...

ownCloud Multiple XSS and SQL Injection Vulnerabilities

ownCloud is prone to multiple XSS and SQL injection vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ownCloud 'lib/db.php' SQL Injection Vulnerability

ownCloud is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if...

PT-2014-2536

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.11 ownCloud versions 5.x prior to 5.0.6 Description The issue allows remote authenticated users to download arbitrary calendars due to improper ownership checking of a calendar. This is achieved via the calendar ...

CVE-2013-2043: Undefined Security Weakness

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendarid parameter...

ownCloud 'filename'参数远程代码执行漏洞

Bugtraq ID:66000 CVE ID:CVE-2014-2044 ownCloud是一款开源的私有云服务器。 ownCloud不正确过滤用户提交的'filename'参数数据，允许远程攻击者利用漏洞提交恶意POST请求执行任意代码。受影响脚本为： /owncloud/owncloud/?app=files&getfile=ajax%2Fupload.php POST 'filename' parameter 0 ownCloud 4.0.x ownCloud 4.5.x 厂商补丁： ownCloud ----- ownCloud 5.0已经修复该漏洞，建议用户下载更新：...

ownCloud 4.0.x4.5.x - upload.php?Filename Remote Code Execution

ownCloud 4.0.x4.5.x - upload.php?Filename Remote Code Execution Vulnerability title: Remote Code Execution in ownCloud CVE: CVE-2014-2044 Vendor: ownCloud Product: ownCloud Affected version: 4.0.x & 4.5.x Fixed version: 5.0 Reported by: Alejo Murillo Moya Details: A remote code execution has been...