Incorrect setup of external storage - ownCloud

The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups. The storage class is setup without any setup information, leading t...

Disclosure of arbitrary certificate files - ownCloud

The 'Import root certificate' ability that users are able to use once filesexternal is enabled allows users to import their own root certificates for connections. e.g. server-to-server shares to servers using a self-signed certificate or external storages The functionality was using the PHP OpenS...

Server: Incorrect setup of external storage

The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups. The storage class is setup without any setup information, leading t...

Server: Insecure Direct Object References in Gallery

ownCloud was vulnerable to a insecure direct object reference. Any unauthenticated user would be able to download any image from the server if the gallery app is enabled. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

ownCloud/Nextcloud Unprotected Data Directory (HTTP)

ownCloud/Nextcloud is exposing an unprotected data directory. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

ownCloud: SMB User Authentication Bypass and Persistence

Authentication Bypass ================== The external user authentication app in OwnCloud does not properly authenticate against an SMB server. In it's current implementation, the file owncloud/apps/userexternal/lib/smb.php, line 46-47 uses the command smbclient -L //host/dummy -Uuser%pass, where...

Fedora Update for owncloud FEDORA-2016-377b1a015c

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for owncloud FEDORA-2016-6f479decc6

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for owncloud FEDORA-2016-cfa7b58c7e

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 23 Update: owncloud-8.2.4-1.fc23

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

[SECURITY] Fedora 22 Update: owncloud-8.2.4-1.fc22

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

[SECURITY] Fedora 24 Update: owncloud-8.2.4-1.fc24

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

Updated owncloud packages fix security vulnerabilities

Updated owncloud package fixes security vulnerabilities: The owncloud package has been updated to version 8.0.12, which fixes undisclosed security issues and other bugs...

MGASA-2016-0167 Updated owncloud packages fix security vulnerabilities

Updated owncloud package fixes security vulnerabilities: The owncloud package has been updated to version 8.0.12, which fixes undisclosed security issues and other bugs...

ownCloud: doc.owncloud.com: PHP info page disclosure

URL :- http://doc.owncloud.com/t/ Description :- phpinfo is a debug functionality that prints out detailed information on both the system and the PHP configuration. An attacker can obtain information such as: •Exact PHP version. •Exact OS and its version. •Details of the PHP configuration...

ownCloud: Open Redirector via (apps/files_pdfviewer) for un-authenticated users.

Affected Products: OWNCLOUD https://demo.owncloud.org/index.php/apps/filespdfviewer Version Tested: v1.0.712, other versions might be vulnerable Class: Open Redirector Remote: Yes A non authenticated user can be easily tricked into following one of the following links in order to download a...

ownCloud: doc.owncloud.org: XSS via Referrer

Hi, The Referer Header in the following request, can be used to trigger an XSS. GET /promote/ HTTP/1.1 Host: doc.owncloud.org User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:45.0 Gecko/20100101 Firefox/45.0 Referer: javascript:alert'XSS'; Accept:...

ownCloud: Cross site scripting in apps.owncloud.com

Vulenrablity Affects : http://apps.owncloud.com/lib/freecaptcha/freecapwrap.php POC : URI was set to : "alert1 url : http://apps.owncloud.com/lib/freecaptcha/freecapwrap.php/"prompt1 Screenshot : enclosed...

Bypass of application specific PIN - ownCloud

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...

Mobile App: Bypass of application specific PIN

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...