CVE-2016-1500

ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "fileversions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belongi...

CVE-2016-1499

ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service CPU consumption via the force parameter to index.php/apps/files/ajax/scan.php...

CVE-2016-1501

ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages...

CVE-2016-1498

Cross-site scripting XSS vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL...

Information disclosure

ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service CPU consumption via the force parameter to index.php/apps/files/ajax/scan.php...

Code injection

ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "fileversions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belongi...

CVE-2016-1501

Summary: CVE-2016-1501 affects ownCloud Server. Vulnerability allows authenticated remote users to disclose the server installation path via exception messages. Affected versions: ownCloud Server < 8.0.9 and 8.1.x

CVE-2016-1498

CVE-2016-1498 is an XSS vulnerability in the ownCloud Server OCS discovery provider. It affects the OCS discovery provider component prior to: 7.0.12, 8.0.x prior to 8.0.10, 8.1.x prior to 8.1.5, and 8.2.x prior to 8.2.2, allowing remote attackers to inject arbitrary script via URL vectors. Multi...

CVE-2016-1499

ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service CPU consumption via the force parameter to index.php/apps/files/ajax/scan.php...

CVE-2016-1501

ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages...

CVE-2016-1498

Cross-site scripting XSS vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL...

CVE-2016-1500

ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "fileversions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belongi...

CVE-2016-1500

ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "fileversions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belongi...

CVE-2016-1500

CVE-2016-1500 affects ownCloud Server releases prior to certain patch levels (7.0.12; 8.0.x < 8.0.10; 8.1.x < 8.1.5; 8.2.x

CVE-2016-1499

ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service CPU consumption via the force parameter to index.php/apps/files/ajax/scan.php...

CVE-2016-1498

Cross-site scripting XSS vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL...

CVE-2016-1499

CVE-2016-1499 affects ownCloud Server: information exposure via directory listing and possible CPU denial of service when the force parameter is used in index.php/apps/files/ajax/scan.php. Affected products/versions: ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2. The r...

CVE-2016-1501

ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages...

PT-2016-4845

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 8.0.10 ownCloud Server versions 8.1.x prior to 8.1.5 ownCloud Server versions 8.2.x prior to 8.2.2 Description The issue allows remote authenticated users to obtain sensitive information from a directory listi...

CVE-2016-1501: Exposure of Sensitive Information to an Unauthorized Actor

ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages...