CVE-2013-0298

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted iCalendar file to the calendar application, the 2 dir or 3 file parameter to apps/filespdfviewer/viewer.php, or the 4 mountpoint parameter...

CVE-2013-0297

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 sitename or 2 siteurl parameter to apps/external/ajax/setsites.php...

CVE-2013-0307

Cross-site scripting XSS vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter...

CVE-2013-0297

CVE-2013-0297 concerns multiple XSS flaws in ownCloud prior to 4.0.12 and 4.5.x prior to 4.5.7. The vulnerabilities allow remote authenticated administrators to inject arbitrary script/HTML via the site_name or site_url parameters to apps/external/ajax/setsites.php. Connected sources confirm affe...

CVE-2013-0298

OwnCloud 4.5.x is vulnerable to multiple XSS via (1) an iCalendar file in the calendar app, (2) the dir or (3) file parameters to apps/files_pdfviewer/viewer.php, or (4) the mountpoint parameter to /apps/files_external/addMountPoint.php. Root cause: improper handling of untrusted input in these c...

PT-2014-4451

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.15 ownCloud versions 6.x prior to 6.0.2 Description The issue allows remote attackers to access user files due to the default Flash Cross Domain policies. Recommendations For ownCloud versions prior to 5.0.15,...

PT-2014-2502

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.7 Description The issue allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the quota parameter to "/core/settings/ajax/setquota.php". Additionally,...

PT-2014-4450

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 6.0.2 Description A session fixation issue allows remote attackers to hijack web sessions when PHP is configured to accept session parameters through a GET request. Recommendations For ownCloud versions prior to 6.0....

PT-2014-2442

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the site name or site url parameter to t...

PT-2014-2443

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.6 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various means, including: - a...

PT-2014-2444

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description The issue allows remote attackers to hijack user authentication for various requests. This includes changing the timezone via the lat and lng parameters to...

PT-2014-2450

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description A cross-site scripting XSS issue allows remote administrators to inject arbitrary web script or HTML via the group input field parameter in the settings.php...

PT-2014-2446

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 Description A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for requests that change the timezone via the timezone parameter in the...

PT-2014-2445

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.6 Description The issue allows remote attackers to hijack the authentication of users for various requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities. Specifically...

PT-2014-2522

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.10 ownCloud versions 5.x prior to 5.0.5 Description The contacts application in ownCloud does not properly check the ownership of contacts. This allows remote authenticated users to download arbitrary contacts vi...

PT-2014-2534

Name of the Vulnerable Software and Affected Versions ownCloud versions 5.0.0 through 5.0.5 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the tag parameter to "apps/bookmarks/ajax/addBookmark.php" or the dir parameter to...

PT-2014-2532

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.15 ownCloud versions 4.5.x through 4.5.11 ownCloud versions 5.x through 5.0.6 Description The issue allows remote authenticated users to access arbitrary files via unspecified vectors due to a directory traversal...

PT-2014-2533

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.15 ownCloud versions 4.5.x prior to 4.5.11 ownCloud versions 5.0.x prior to 5.0.6 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, which can...

PT-2014-2535

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.15 ownCloud versions 4.5.x prior to 4.5.11 ownCloud versions 5.0.x prior to 5.0.6 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This is achieved via the url...

PT-2014-2537

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect url parameter in the Login Page index.php. Recommendations For...