CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36250

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past...

CVE-2020-36252

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number...

CVE-2020-10254

An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview...

CVE-2020-10252

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue via the apps/filessharing/external remote parameter, an authenticated attacker can interact with local services blindly aka Blind SSRF or conduct a Denial Of Service attack...

CVE-2020-36251

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...

Server side request forgery (ssrf)

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue via the apps/filessharing/external remote parameter, an authenticated attacker can interact with local services blindly aka Blind SSRF or conduct a Denial Of Service attack...

Design/Logic Flaw

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past...

Design/Logic Flaw

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

Design/Logic Flaw

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...

Design/Logic Flaw

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number...

CVE-2020-36248

CVE-2020-36248 affects the Android app OwnCloud up to version 2.14 (before 2.15). The vulnerability arises because an attacker can use adb to inject a PIN preferences value into a backup archive, allowing the PIN lock to be bypassed when restoring that archive. The available connected documents c...

CVE-2020-36248

The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive...

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36249

The CVE-2020-36249 case concerns OwnCloud File Firewall (pre-2.8.0) failing to enforce file-type restrictions on public shares. Affected product is ownCloud Server’s File Firewall component; the root cause is described as improper enforcement of shared-file type restrictions. Public shares could ...

CVE-2020-36250

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past...

CVE-2020-36250

The CVE-2020-36250 entry applies to the ownCloud Android client, affected versions prior to 2.15. The vulnerability arises from a bypass of the lock protection mechanism when the system date/time is moved to the past. The connected sources confirm this behavior but do not provide a published reme...

CVE-2020-36251

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...

CVE-2020-36251

Summary (supported by provided documents): CVE-2020-36251 affects OwnCloud Server and concerns a permissions/access control issue in group shares. Specifically, as described in the CVE, an attacker who already has non-administrative access to a group share can remove everyone else’s access to tha...

CVE-2020-36252

CVE-2020-36252 affects OwnCloud Server 10.x prior to 10.3.1. An attacker who has one outgoing share from a victim can access any version of any file by requesting a predictable ID number, exploiting a privilege/access-control flaw. The vulnerability impacts confidentiality (high) and is classifie...