PT-2017-18606

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 8.2.12 ownCloud Server versions 9.0.x prior to 9.0.10 ownCloud Server versions 9.1.x prior to 9.1.6 ownCloud Server versions 10.0.x prior to 10.0.2 Description The issue allows for XSS on error pages by...

CVE-2017-8896: Improper Neutralization of Input During Web Page Generation

ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters...

CVE-2017-9340: Undefined Security Weakness

An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2...

ownCloud Information Disclosure Vulnerability (CNVD-2017-22086)

ownCloud is a free and open source personal cloud storage solution from the German company ownCloud, which provides file management, music storage, calendaring and other features. ownCloud server is a server version. A security vulnerability exists in versions of ownCloud Server prior to 10.0.2. ...

ownCloud Remote Elevation of Privilege Vulnerability

ownCloud is a free and open source personal cloud storage solution from the German company ownCloud, which provides file management, music storage, calendaring and other features. ownCloud server is a server version. There is a security vulnerability in ownCloud Server. An attacker can utilize th...

ownCloud cross-site scripting vulnerability (CNVD-2017-16363)

ownCloud is the open source file synchronization and sharing solution. A cross-site scripting vulnerability exists in ownCloud, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions,...

ownCloud Error Page Cross-Site Scripting Vulnerability

ownCloud is the open source file synchronization and sharing solution. A cross-site scripting vulnerability exists in ownCloud, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions,...

XSS in Error Page - ownCloud

A Attacker can inject HTML script code into a error message Affected Software ownCloud Server 10.0.2 CVE-2017-8896 ownCloud Server 9.1.6 CVE-2017-8896 ownCloud Server 9.0.10 CVE-2017-8896 ownCloud Server 8.2.12 CVE-2017-8896 Action Taken Escape output Acknowledgements The ownCloud team thanks the...

Share tokens for public calendars disclosed - ownCloud

A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token. Affected Software ownCloud Server 10.0.2 CVE-2017-9339 Action Taken The error has been fixed and regression test...

Normal user can somehow make admin to delete shared folders - ownCloud

A Attacker is logged in as a normal user and can somehow make admin to delete shared folders Affected Software ownCloud Server 10.0.2 CVE-2017-9340 Action Taken Adjust privileges Acknowledgements The ownCloud team thanks the following people for their research and responsible disclosure of the...

XSS in search dialogue - ownCloud

Inadequate escaping lead to XSS vulnerability in the search module. To be exploitable an user has to write or paste malicious content into the search dialogue. Affected Software ownCloud Server 10.0.2 CVE-2017-9338 ownCloud Server 9.1.6 CVE-2017-9338 ownCloud Server 9.0.10 CVE-2017-9338 ownCloud...

XSS in Error Page - ownCloud

A Attacker can inject HTML script code into a error message Affected Software ownCloud Server 10.0.2 CVE-2017-8896 ownCloud Server 9.1.6 CVE-2017-8896 ownCloud Server 9.0.10 CVE-2017-8896 ownCloud Server 8.2.12 CVE-2017-8896 Action Taken Escape output Acknowledgements The ownCloud team thanks the...

XSS in search dialogue - ownCloud

Inadequate escaping lead to XSS vulnerability in the search module. To be exploitable an user has to write or paste malicious content into the search dialogue. Affected Software ownCloud Server 10.0.2 CVE-2017-9338 ownCloud Server 9.1.6 CVE-2017-9338 ownCloud Server 9.0.10 CVE-2017-9338 ownCloud...

Share tokens for public calendars disclosed - ownCloud security advisory

Platform: ownCloud Server Versions: 10.0.2 Date: 5/31/2017 Risk level: Medium CVSS v3 Base Score: 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CWE: Information Exposure Through Directory Listing CWE-548...

Security advisory: Normal user can somehow make admin to delete shared folders

Platform: ownCloud Server Versions: 10.0.2 Date: 5/31/2017 Risk level: Medium CVSS v3 Base Score: 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CWE: Improper Privilege Management CWE-269 HackerOne report:Â 166581...

XSS in Error Page - ownCloud security advisory

Platform: ownCloud Server Versions: 10.0.2 Date: 5/31/2017 Risk level: Medium CVSS v3 Base Score: 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CWE: Improper Neutralization of Input During Web Page Generation ‘Cross-site Scripting’ CWE-79 HackerOne report: 215410...

NextCloud / OwnCloud Cross Site Scripting

================================================================== Nextcloud/Owncloud - Reflected Cross Site Scripting in error pages ================================================================== Information ------------------------------------------------------------------ Name:...

ownCloud: password reset email spamming

Description: The email API https://yoursite/index.php/login?user=admin to reset password is unlimited and can be used as a email bomb vuln address:https://yoursite/index.php/lostpassword/email Reproduce steps:use demo.owncloud.org as example 1.https://demo.owncloud.org/index.php/login has a defau...

ownCloud: doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)

BIND9 TKEY Vulnerability + Exploit Denial of Service...

Nextcloud Server and ownCloud Server Content Spoofing Vulnerabilities

ownCloud is a free and open source personal cloud storage solution from German company ownCloud. nextcloud is an open source self-hosted file synchronization and sharing communication application platform. ownCloud Server and Nextcloud Server are both a server version of one of them. A security...