CVE-2014-3963

Consolidated details: CVE-2014-3963 affects ownCloud Server before 6.0.1. The root cause is an improper permissions check, enabling remote authenticated users to access arbitrary preview pictures via unspecified vectors. The vulnerability impacts preview access and does not indicate remote code e...

CVE-2014-3834

OwnCloud CVE-2014-3834 affects OwnCloud Server prior to 6.0.3. The root cause is improper authorization checks where the service does not verify that a user has access permissions, allowing an authenticated user to (1) access another user’s contacts via the address book and (2) rename files via u...

CVE-2014-3837

Affected software: ownCloud Server prior to 6.0.3. Vulnerability: the file_id in the documents app is auto-incremented, enabling remote authenticated users to enumerate shared files. Root cause: sequential file_id values used instead of a random access token. Impact: authenticated users could enu...

CVE-2014-2054

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2014-3832

CVE-2014-3832 is an XSS vulnerability in the Documents component of ownCloud Server 6.0.x before 6.0.3. The issue allows an attacker to inject arbitrary web script or HTML via unspecified vectors, with the root cause possibly related to the print_unescaped function. Public references indicate aff...

CVE-2014-3838

Summary (Concrete details from provided documents): The CVE-2014-3838 issue affects ownCloud Server before 5.0.16 and 6.0.x before 6.0.3. The root cause is improper authorization checks in the core, allowing remote authenticated users with access to multiple accounts to read the names of files be...

CVE-2013-1941

The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-3963

ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors...

CVE-2013-0204

settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings...

CVE-2012-5336

The CVE-2012-5336 issue affects ownCloud Server versions prior to 4.0.8. The root cause is improper validation of the user_id session variable in lib/base.php, which allows remote authenticated users to read arbitrary files via WebDAV. Affected software: ownCloud Server

CVE-2012-5056

OwnCloud Server prior to 4.0.8 is affected by multiple XSS vulnerabilities. The issues allow remote attackers to inject arbitrary script/HTML via three vectors: (1) readyCallback in apps/files_odfviewer/src/webodf/webodf/flashput/PUT.swf, (2) root parameter to apps/gallery/templates/index.php, an...

CVE-2012-5336

lib/base.php in ownCloud before 4.0.8 does not properly validate the userid session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV...

CVE-2014-3835

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

Deserialization of Untrusted Data in core - ownCloud

Due to the deserialization of unstrusted data in core an attacker might be able to delete arbitrary files from the filesystem or executing arbitrary SQL queries. This issue has been found in a widely used third-party library, we have removed the component due to general quality concerns from the...

Improper authorization checks in core - ownCloud

Due to an improper authorization check in core an attacker with access to at least two user account is able to access the file names of other users. Our post-mortem audit showed that this vulnerability does not leak any content of the file or the directory structure except the filename. Affected...

Enumeration of shared files in documents - ownCloud

Due to using the auto-incrementing fileid instead of the random generated token to access files in the documents app an authenticated users could enumerate shared files of other users. Affected Software ownCloud Server 6.0.3 CVE-2014-3837 Action Taken We replaced the usage of fileid with our rand...

CSRF in documents - ownCloud

Due to not verifying whether a request was intentionally provided by the user who submitted an request the documents application is vulnerable against several CSRF attacks. An attacker could have used this to arbitrary modify existing files or rename it. Affected Software ownCloud Server 6.0.3...

Improper authorization checks in files_external - ownCloud

Due to not verifying whether an user has been granted access to add external storages an authenticated user could even mount external storage e.g. SMB/FTP/etc. without permission. Affected Software ownCloud Server 6.0.3 CVE-2014-3835 ownCloud Server 5.0.16 CVE-2014-3835 Action Taken We reviewed t...

Improper authorization checks in contacts - ownCloud

Due to not verifying whether an user has been granted access to an address book, authenticated users are able to access arbitrary contacts of other users. Affected Software ownCloud Server 6.0.3 CVE-2014-3834 Action Taken We reviewed the access-control of the contacts application and ensured that...

Mandriva Linux Security Advisory : owncloud (MDVSA-2014:101)

Updated owncloud packages fix security vulnerabilities : Owncloud versions 5.0.16 and 6.0.3 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...