Disclosure of sensitive credentials and configuration in containerized deployments - ownCloud

The “graphapi” app relies on a third-party library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information includes all the environment variables of the webserver. In containerized deployments, these environment variabl...

ownCloud Phpinfo Reader

Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app graph installed contain a test file which prints phpinfo to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter. Docker m...

Malicious code in owncloud-js-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26163abe3e5a983c952c08703d6b6763543c0fc989b54027001520a78d7b145a The OpenSSF Package Analysis project identified 'owncloud-js-dev' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1505 Malicious code in owncloud-js-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26163abe3e5a983c952c08703d6b6763543c0fc989b54027001520a78d7b145a The OpenSSF Package Analysis project identified 'owncloud-js-dev' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

WS-2023-0400

Owncloud does not throw a CrossSiteRequestForgeryException, if the request does not contain the requesttoken header...

WS-2023-0209

In OwnCloud before 10.12.2, federated share permissions can be increased trivially by recipient. It allows a malicious user to gain access to resources they should not have permission to...

ownCloud: Federated share permissions can be increased by recipient

The federated share permissions in Nextcloud allowed recipients to increase their permissions by sending a request to the server with the share token and ID, resulting in a security vulnerability...

Edit of share permissions causes public links misbehaviour - ownCloud

Changes to the permissions of a share where propagated to public links of child resources...

SQLInjection in FileContentProvider.kt - ownCloud

Due to some insecure code in a exported content provider an attacker with local access could retrieve information from the ownCloud app database through SQL injection...

SUSE CVE-2014-9043

The userldap aka LDAP user and group backend application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind...

SUSE CVE-2021-44537

ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution...

CVE-2023-23948

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in FileContentProvider.kt. This issue can lead to information disclosure. Two databases, filelist and ownclouddatabase, are...

CVE-2023-24804

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal...

Sql injection

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in FileContentProvider.kt. This issue can lead to information disclosure. Two databases, filelist and ownclouddatabase, are...

Path traversal

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal...

CVE-2023-23948 ownCloud Android app vulnerable to SQL Injection

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in FileContentProvider.kt. This issue can lead to information disclosure. Two databases, filelist and ownclouddatabase, are...

CVE-2023-23948 ownCloud Android app vulnerable to SQL Injection

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in FileContentProvider.kt. This issue can lead to information disclosure. Two databases, filelist and ownclouddatabase, are...

CVE-2023-23948

The CVE-2023-23948 entry concerns the ownCloud Android app (v2.21.1) vulnerable to SQL injection in FileContentProvider.kt, leading to potential information disclosure. The issue affects two databases: filelist (deprecated in v3.0) and owncloud_database, with injections in the latter remaining re...

CVE-2023-23948

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in "FileContentProvider.kt". This issue can lead to information disclosure. Two databases, "filelist" and "ownclouddatabase", are...

CVE-2023-23948 ownCloud Android app vulnerable to SQL Injection

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in FileContentProvider.kt. This issue can lead to information disclosure. Two databases, filelist and ownclouddatabase, are...