CVE-2012-5056: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 readyCallback parameter to apps/filesodfviewer/src/webodf/webodf/flashput/PUT.swf, the 2 root parameter to apps/gallery/templates/index.php, or...

CVE-2014-3832: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the printunescaped function...

CVE-2014-3834: Undefined Security Weakness

ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to 1 access the contacts of other users via the address book or 2 rename files via unspecified vectors...

CVE-2014-3835: Undefined Security Weakness

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

CVE-2014-3833: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the 1 Gallery and 2 core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the printunescaped function...

CVE-2013-0204: Improper Control of Generation of Code

settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings...

CVE-2014-2054: Undefined Security Weakness

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2012-5336: Improper Input Validation

lib/base.php in ownCloud before 4.0.8 does not properly validate the userid session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV...

CVE-2014-3963: Undefined Security Weakness

ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors...

CVE-2014-2056: Undefined Security Weakness

PHPDocX, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2013-1941: Undefined Security Weakness

The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-2053: Undefined Security Weakness

getID3 before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2014-3837: Undefined Security Weakness

The document application in ownCloud Server before 6.0.3 uses sequential values for the fileid, which allows remote authenticated users to enumerate shared files via unspecified vectors...

CVE-2012-5057: Undefined Security Weakness

CRLF injection vulnerability in ownCloud Server before 4.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path parameter...

CVE-2014-2055: Undefined Security Weakness

SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2014-3838: Undefined Security Weakness

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts...

PT-2014-4453

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity X...

PT-2014-5539

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue allows remote attackers to hijack user authentication for various requests, including conducting cross-site scripting XSS attacks, modifying files, or renaming files. Recommendation...

PT-2014-4455

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 SabreDAV versions prior to 1.7.11 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other...

PT-2014-2297

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 4.0.8 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the readyCallback parameter to "apps/files odfviewer/src/webodf/webodf/flashput/PUT.swf", th...