2432 matches found
CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...
CVE-2023-7273
The CVE-2023-7273 entry concerns Kiteworks OwnCloud and is supported by multiple sources indicating a Cross-Site Request Forgery (CSRF) vulnerability. Affected component/condition: CSRF in Kiteworks OwnCloud where, if a request has no Authorization header, the rewrite rule assigns an empty string...
CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...
CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...
CVE-2023-7273
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...
ownCloud 安全漏洞
ownCloud is a suite of personal cloud storage solutions from the US-based company ownCloud. A security vulnerability exists in version 10.12 and earlier versions of ownCloud that stems from the presence of cross-site request forgery, allowing an unauthenticated attacker to forge requests...
PT-2024-15265 · Kiteworks · Kiteworks Owncloud
Name of the Vulnerable Software and Affected Versions: Kiteworks OwnCloud affected versions not specified Description: Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty strin...
CVE-2023-7273: Cross-Site Request Forgery (CSRF)
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...
ownCloud < 10.15.0 Multiple Vulnerabilities
ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...
Cross-site Request Forgery in diagnostics app - ownCloud
Improper handling of CSRF protection in the diagnostics app in combination with the SameSite-Cookie setting being set to None allows cross site invocation of an admin API...
ownCloud Phpinfo Reader
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ownCloud Phpinfo Reader', 'Description' = %q Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Owncloud Graph_Api
🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the...
ownCloud < 10.14.0 Multiple Improper Input Validation Vulnerabilities
ownCloud is prone to multiple improper input validation vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
ownCloud < 10.13.3 Improper Input Validation Vulnerability
ownCloud is prone to an improper input validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Authentication Bypass Using Pre-signed URLs - ownCloud
Improper validation may allow an attacker to bypass authentication and gain access to users’ files. Prior knowledge of a username and a file path is needed in order to gain access to a certain file...
Denial of Service in Comments API - ownCloud
Insufficient input validation in the Comments Plugin may allow an authenticated attacker to cause a Denial of Service...
Improper Validation in the User Profile Metadata - ownCloud
Improper Validation in the User Profile Metadata may allow an authenticated attacker to edit their own profile in a way that consumes a substantial amount of resources, creating a Denial of Service...
Improper Validation in the User's Avatar Mechanism - ownCloud
Improper Validation in the User’s Avatar Mechanism may allow an authenticated attacker to edit their own profile in a way that consumes a substantial amount of resources, creating a Denial of Service...
Biometric Authentication Bypass - ownCloud
Improper validation in the Biometric authentication process may allow an attacker to bypass that process and gain unauthorized access. This attack requires physical access to the vulnerable device...
ownCloud: Authentication Bypass with usage of PreSignedURL
The ownCloud Infinite Scale oCIS was identified to be vulnerable to an authentication bypass vulnerability due to an issue with the default-enabled PreSignedURL feature. The vulnerability allowed access to any file without authentication, given the prior knowledge of the username and filename. Th...