Bypass of application specific PIN

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...

ownCloud: doc.owncloud.org: X-XSS-Protection not enabled

X-Xss-Protection @https://doc.owncloud.org/ has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and 1;...

ocloud for owncloud - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application ocloud for owncloud published at the 'play' market has multiple vulnerabilities...

ownCloud: Reflected XSS in owncloud.com

xss does work only for inetrnet explorer, for all versions how to reproduce? : 1. to use internet explorer browseri have test with ie11 2. go to page https://owncloud.com/wp-123.php?action=document.location.href=location.hash.slice1javascript:alertdocument.domain 3. will be alert box with name of...

HackerOne: External links should use rel="noopener" or use the redirect service

This is a rather low severity one and a successful exploitation relies on unlikely user interaction as well as the ability to control the HTML output of an remote host. Furthermore it is a kinda new hardening features in some browsers. Though one can work around this using "noreferrer" which is...

ownCloud: doc.owncloud.org has missing PHP handler

When visiting the following URL https://doc.owncloud.org/server/8.2/go.php?to=admin-backup the web server does interpret the php code but delivers the php code itself. This might expose internal information to anyone visiting the website...

Fedora 23 : owncloud-8.0.10-1.fc23 (2016-a576196426)

This update provides the new upstream patch release of ownCloud 7.0.12 for EPEL 6, 8.0.10 for all other distributions. It also adds a 'well-known' redirect for WebDAV alongside the existing ones for CalDAV and CardDAV - if you don't know what this is, don't worry. These are bugfix updates which...

Fedora 23 : owncloud-8.0.9-1.fc23 (2015-a6be3a6810)

This update provides the latest upstream release of ownCloud in the current minor series - 8.0.9 for all releases but EPEL 6, 7.0.11 for EPEL 6. These releases come with unspecified 'security improvements', so updating quickly is recommended. As usual, a minor update should apply smoothly, but we...

Fedora 21 : owncloud-8.0.9-1.fc21 (2015-a117082cd2)

This update provides the latest upstream release of ownCloud in the current minor series - 8.0.9 for all releases but EPEL 6, 7.0.11 for EPEL 6. These releases come with unspecified 'security improvements', so updating quickly is recommended. As usual, a minor update should apply smoothly, but we...

Fedora 22 : owncloud-8.0.9-1.fc22 (2015-85760004ca)

This update provides the latest upstream release of ownCloud in the current minor series - 8.0.9 for all releases but EPEL 6, 7.0.11 for EPEL 6. These releases come with unspecified 'security improvements', so updating quickly is recommended. As usual, a minor update should apply smoothly, but we...

ownCloud Multiple Vulnerabilities (Mar 2016) - Windows

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

ownCloud Multiple Vulnerabilities (Mar 2016) - Linux

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

ownCloud Information Exposure Vulnerability (Feb 2016) - Windows

ownCloud is prone to an information exposure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud Information Exposure Vulnerability (Feb 2016) - Linux

ownCloud is prone to an information exposure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud 8.0.x < 8.0.9, 8.1.x < 8.1.4 Path Disclosure Vulnerability - Windows

ownCloud is prone to path disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud 8.0.x < 8.0.9, 8.1.x < 8.1.4 Path Disclosure Vulnerability - Linux

ownCloud is prone to path disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud: DROWN Attack

Hi, I want to report a drown attack in .owncloud.com. A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable serve...

Protecting Personal Information: Freedom Box

FreedomBox is a personal server that protects your privacy. It hosts on demand applications such as file sharing, shared calendaring, instant messaging, secure voice conference calling, blog and wiki. FreedomBox is a free software stack, a subset of the Debian universal operating system, that can...

ownCloud: owncloud.com: Persistent XSS In Account Profile

Quotation marks are not sanitized in one of the HTML tags inside of the profile when dealing with first & last names. It is an tag. In the attached PoC screenshot, I included a functional first name that triggers an alert call. Inside, I pasted the HTML tag where it breaks. I don't know owncloud...

Mageia: Security Advisory (MGASA-2016-0040)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...