2432 matches found
PT-2021-21073
Name of the Vulnerable Software and Affected Versions: ownCloud server versions prior to 10.8.0 Description: The issue allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL. Recommendations: For versions prior to 10.8.0,...
PT-2021-21075
Name of the Vulnerable Software and Affected Versions: ownCloud Server versions prior to 10.8.0 Description: The issue allows an attacker to bypass permission checks for upload only shares and list metadata about the share. This is related to the shareinfo controller in the ownCloud Server...
PT-2021-21074
Name of the Vulnerable Software and Affected Versions: ownCloud Server versions prior to 10.8.0 Description: The issue allows an attacker to bypass password protection on public links by forcing a target client to use a controlled cookie, specifically through session fixation. Recommendations: Fo...
CVE-2021-35949: Incorrect Authorization
The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share...
CVE-2021-35947: Generation of Error Message Containing Sensitive Information
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...
CVE-2021-35946: Improper Privilege Management
A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions...
PT-2021-21072
Name of the Vulnerable Software and Affected Versions: ownCloud versions prior to 10.8 Description: A receiver of a federated share with access to the database could update the permissions and therefore elevate their own permissions. Recommendations: For ownCloud versions prior to 10.8, update to...
WS-2021-0392
An issue was found in OwnCloud's "userldap" plugin before v0.15.4. LDAP password field can be exploited with newline chars \r\n in order to communicate with protocols like SMTP, Redis and, generally speaking, with all services those speak plain text protocols e.g. postgres, memcached, etc...
ownCloud < 10.8 Multiple Vulnerabilities
ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...
Owncloud ownCloud 授权问题漏洞
Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. An authorization issue vulnerability exists in ownCloud Server, which stems from a session cookie not being reset after authenticating against a public link. An attacker could exploit this vulnerability to...
ownCloud 安全漏洞
Owncloud ownCloud is a personal cloud storage solution from the American company ownCloud Owncloud. A security vulnerability exists in ownCloud Server that stems from the ability to bypass permission checks for file deletion by using the shareinfo API. The vulnerability can be exploited by an...
Owncloud ownCloud 权限许可和访问控制问题漏洞
Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. The ownCloud Server suffers from a Privilege License and Access Control Issue vulnerability that stems from the ability of a federated share recipient to increase privileges, which can lead to bypassing...
ownCloud 信息泄露漏洞
Owncloud ownCloud is a personal cloud storage solution from US-based ownCloud Owncloud. An information disclosure vulnerability exists in ownCloud Server that stems from a generated error message containing sensitive information. An attacker could trigger the error by appending certain characters...
Shareinfo url doesn't verify file drop permissions - ownCloud
The permission check for a file drop upload only share could be circumvented by using the shareinfo API. This allowed to see from the files in the filedrop but didn’t allow downloads...
Federated share recipient can increase permissions - ownCloud
The receiver of a federated share could update the permissions granted to the receivers of the share...
Session fixation on public links - ownCloud
The session cookies were not reset after authenticating for public links...
files_antivirus 代码问题漏洞
filesantivirus is a ClamAV-based ownCloud antivirus application. A security vulnerability exists in filesantivirus, which allows remote attackers to exploit the vulnerability to compromise a target system. The affected products and versions are as follows:files antivirus:Prior to 1.0.0...
files_antivirus 操作系统命令注入漏洞
filesantivirus is a ClamAV-based ownCloud antivirus application. filesantivirus before 1.0.0 suffers from an operating system command injection vulnerability that allows remote users to execute arbitrary shell commands on the target system...
Upload of malicious files to publicly shared folders - ownCloud
It was possible to upload malicious files to a public share. The malicious files were detected but ended up in a state where they were not deleted...