CVE-2013-1890

CVE-2013-1890 affects ownCloud Server versions before 5.0.1, with multiple XSS vulnerabilities exploitable via (1) the new_name parameter to apps/bookmarks/ajax/renameTag.php and (2) multiple unspecified parameters to files in apps/contacts/ajax/. The underlying issue is cross-site scripting that...

CVE-2013-2046

SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x before 4.5.11 and 5.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-2045

CVE-2013-2045 affects ownCloud Server prior to 5.0.6 (and related advisory notes) where lib/db.php does not neutralize special elements passed to SQL queries, enabling SQL injection by remote authenticated users. The issue is limited to authenticated access and the impact is described as arbitrar...

CVE-2013-2046

CVE-2013-2046 affects ownCloud Server: SQL injection in lib/bookmarks.php. Vulnerable in 4.5.x before 4.5.11 and 5.x before 5.0.6. Root cause: unsafely constructed SQL via bookmarks feature, allowing remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Impact per ...

PT-2014-2516

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the new name parameter to the "apps/bookmarks/ajax/renameTag.php" API endpoint or multiple...

PT-2014-2517

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands, related to the contacts application in ownCloud Server. Recommendations For versions prior to 5.0.1, update to...

CVE-2013-2045: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/db.php in ownCloud Server 5.0.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-2046: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x before 4.5.11 and 5.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

PT-2014-2539

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 4.5.x through 4.5.10 ownCloud Server versions 5.x through 5.0.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For ownCloud Server versions 4.5.x through...

CVE-2013-1893: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in addressbookprovider.php in ownCloud Server before 5.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to the contacts application...

CVE-2013-1890: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 newname parameter to apps/bookmarks/ajax/renameTag.php or 2 multiple unspecified parameters to unknown files in apps/contacts/ajax/...

PT-2014-2538

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 5.0.x through 5.0.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For ownCloud Server versions 5.0.x through 5.0.5, update to version 5.0.6 or later to resol...

MGASA-2014-0120 Updated owncloud packages fix security vulnerabilities and bugs

Updated owncloud packages fix security vulnerabilities: Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information...

Updated owncloud packages fix security vulnerabilities and bugs

Updated owncloud packages fix security vulnerabilities: Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information...

ownCloud 4.0.x / 4.5.x Remote Code Execution

Vulnerability title: Remote Code Execution in ownCloud CVE: CVE-2014-2044 Vendor: ownCloud Product: ownCloud Affected version: 4.0.x & 4.5.x Fixed version: 5.0 Reported by: Alejo Murillo Moya Details: A remote code execution has been found and confirmed within ownCloud as an authenticated user. A...

PT-2014-9123

Name of the Vulnerable Software and Affected Versions Owncloud versions 5.0.15 and earlier, Owncloud versions 6.0.2 and earlier Description The issue concerns several unspecified security vulnerabilities in Owncloud. For more information, refer to the upstream Changelog. Recommendations For...

ownCloud 6.0.0a File Deletion / XSS / CSRF

Exploit Title: ownCloud 6.0.0a File Deletion XSS and CSRF Protection Bypass Vendor Homepage: www.ownCloud.org OwnCloud Version: 6.0.0a Browsers tested: Iceweasel 22.0; Internet Explorer 11; Server: Debian. Default LAMP set-up. Exploit Author: James Sibley absane Blog: http://blog.noobroot.com...

CVE-2013-1967

Cross-site scripting XSS vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2013-1967

CVE-2013-1967 describes a Cross-site scripting (XSS) vulnerability in flashmediaelement.swf used by MediaElement.js before 2.11.2. The flaw affects ownCloud Server deployments, specifically 5.0.x before 5.0.5 and 4.5.x before 4.5.10, where an attacker can inject arbitrary script or HTML via the f...

CVE-2013-1967

Cross-site scripting XSS vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter...