CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36250

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past...

CVE-2020-36252

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number...

CVE-2020-10254

An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview...

CVE-2020-10252

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue via the apps/filessharing/external remote parameter, an authenticated attacker can interact with local services blindly aka Blind SSRF or conduct a Denial Of Service attack...

CVE-2020-36250

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past...

Server side request forgery (ssrf)

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue via the apps/filessharing/external remote parameter, an authenticated attacker can interact with local services blindly aka Blind SSRF or conduct a Denial Of Service attack...

Design/Logic Flaw

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past...

Design/Logic Flaw

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

Design/Logic Flaw

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...

Design/Logic Flaw

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number...

CVE-2020-36248

CVE-2020-36248 affects the Android app OwnCloud up to version 2.14 (before 2.15). The vulnerability arises because an attacker can use adb to inject a PIN preferences value into a backup archive, allowing the PIN lock to be bypassed when restoring that archive. The available connected documents c...

CVE-2020-36248

The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive...

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36249

The CVE-2020-36249 case concerns OwnCloud File Firewall (pre-2.8.0) failing to enforce file-type restrictions on public shares. Affected product is ownCloud Server’s File Firewall component; the root cause is described as improper enforcement of shared-file type restrictions. Public shares could ...

CVE-2020-36250

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past...

CVE-2020-36250

The CVE-2020-36250 entry applies to the ownCloud Android client, affected versions prior to 2.15. The vulnerability arises from a bypass of the lock protection mechanism when the system date/time is moved to the past. The connected sources confirm this behavior but do not provide a published reme...

CVE-2020-36251

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...

CVE-2020-36251

Summary (supported by provided documents): CVE-2020-36251 affects OwnCloud Server and concerns a permissions/access control issue in group shares. Specifically, as described in the CVE, an attacker who already has non-administrative access to a group share can remove everyone else’s access to tha...

CVE-2020-36252

CVE-2020-36252 affects OwnCloud Server 10.x prior to 10.3.1. An attacker who has one outgoing share from a victim can access any version of any file by requesting a predictable ID number, exploiting a privilege/access-control flaw. The vulnerability impacts confidentiality (high) and is classifie...