2432 matches found
CVE-2012-5610
The CVE-2012-5610 entry describes an Incomplete blacklist vulnerability in ownCloud’s lib/filesystem.php, exploitable by remote authenticated users via uploading a file with a specially crafted name. Affected are ownCloud core versions before 4.0.9 and 4.5.x before 4.5.2. The underlying cause is ...
CVE-2012-5607
The CVE-2012-5607 issue affects versions 4.0.9 and 4.5.0 where the Lost Password reset does not properly validate the security token, enabling a remote timing-attack-based password change. The underlying problem is the token comparison during password reset, which could let an attacker overwrite...
CVE-2012-5607
The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."...
CVE-2012-5608
Cross-site scripting XSS vulnerability in apps/userwebdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters...
CVE-2012-5606
Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the 1 file name to apps/filesversions/js/versions.js or 2 apps/files/js/filelist.js; or 3 event title to 3rdparty/fullcalendar/js/fullcalendar.js...
PT-2012-6056
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file. This is due to an incomplete blacklist vulnerability in lib/migrate.php...
PT-2012-6055
Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters. This affects the apps/user webdavauth/settings.php file...
CVE-2012-5610: Improper Input Validation
Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name...
PT-2012-6053
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions prior to 4.5.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the file name to apps/files versions/js/versions.js or...
CVE-2012-5606: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the 1 file name to apps/filesversions/js/versions.js or 2 apps/files/js/filelist.js; or 3 event title to 3rdparty/fullcalendar/js/fullcalendar.js...
CVE-2012-5607: Undefined Security Weakness
The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."...
PT-2012-6054
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions prior to 4.5.0 Description The issue concerns the "Lost Password" reset functionality, which does not properly check the security token. This allows remote attackers to change an account's...
PT-2012-6057
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions 4.5.x prior to 4.5.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a specially crafted name due to an incomplete blacklist...
CVE-2012-5609: Undefined Security Weakness
Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file...
CVE-2012-5608: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in apps/userwebdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters...
XSS vulnerability in user_webdavauth - ownCloud
A cross-site scripting XSS vulnerability in ownCloud 4.5.x before 4.5.2 allow remote attackers to inject arbitrary web script or HTML via the POST data to settings.php in apps/userwebdavauth/ Affected Software ownCloud Server 4.5.2 CVE-2012-5608 Action Taken It is recommended that all instances a...
Server: XSS vulnerability in user_webdavauth
A cross-site scripting XSS vulnerability in ownCloud 4.5.x before 4.5.2 allow remote attackers to inject arbitrary web script or HTML via the POST data to settings.php in apps/userwebdavauth/ For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...
CVE-2012-4396
Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 file names to apps/userldap/settings.php; 2 url or 3 title parameter to apps/bookmarks/ajax/editBookmark.php; 4 tag or 5 page parameter to...
CVE-2012-4397
Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...