2432 matches found
CVE-2014-1665
Cross-site scripting XSS vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file...
CVE-2014-1665
CVE-2014-1665 is an XSS vulnerability in ownCloud prior to 6.0.1 where an authenticated user could inject script via the filename of an uploaded file. Affected products include ownCloud versions 6.x up to 6.0.1 (with multiple sources citing 6.0.0a and 6.0.0-era builds). Root cause is mishandling ...
CVE-2014-1665: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file...
PT-2018-4174
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 6.0.1 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file, which is a cross-site scripting XSS vulnerability. Recommendations For versio...
OwnCloud Server 10.0 User Enumeration
Class User Enumeration CVE Remote Yes Credit n4xh4ck5 Home https://github.com/n4xh4ck5 Vulnerable Owncloud Server 8.1 to 10.0 Once time authenticated in the application, the Owncloud funcionality let to User enumeration due the different error messages of the server. The vulnerabiblity it finds i...
ownCloud: OS Command Injection via tainted PATH environment variable in findBinaryPath
The PATH environment variable is passed to the find command in owncloud/core/blob/master/lib/private/legacy/helper.php on line 543 is not sanitized for input. If an adversary is able to taint the PATH environment variable, OS command execution is possible utilizing the find command's execute -exe...
ownCloud: Password Complexity Not Enforced On Password Change
Hi! Owncloud does not enforce password complexity on password change, so it's possible to use passwords of any size or form. In example I can set my password to be "a" or "qwerty". How to reproduce: Change your password to something that does not match your required complexity. Proof Of Concept:...
ownCloud: owncloud.com open redirect
Open redirect on owncloud.com...
ownCloud: This is not the security issue.
Here a subdomain path: https://apps.owncloud.com/ a strange thing in this domain is that a new user can not create account but he can login in. On that path:- https://apps.owncloud.com/usermanager/new.php In this path registration file has been removed or something and saying 404 error. I mean wh...
ownCloud Multiple Vulnerabilities (May 2017)
ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if description...
ownCloud Multiple XSS Vulnerabilities
ownCloud is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2017-8896
ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters...
CVE-2017-9339
A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...
Cross site scripting
Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...
Code injection
An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2...
Code injection
A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...
CVE-2017-9340
An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2...
CVE-2017-9338
Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...
CVE-2017-9339
A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...
