CVE-2013-0299

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the timezone for the user via the lat and lng parameters to...

CVE-2013-0301

Cross-site request forgery CSRF vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter...

CVE-2013-0300

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary 2 Google Drive or 3 Dropbox...

CVE-2013-2042

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to 1 apps/bookmarks/ajax/addBookmark.php or 2 apps/bookmarks/ajax/editBookmark.php...

CVE-2013-2041

Multiple cross-site scripting XSS vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tag parameter to apps/bookmarks/ajax/addBookmark.php or 2 dir parameter to apps/files/ajax/newfile.php, which is passed to...

CVE-2013-0297

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 sitename or 2 siteurl parameter to apps/external/ajax/setsites.php...

CVE-2014-1276

CVE-2014-1276 affects Apple iOS prior to 7.1 via the IOKit HID Event interface. The vulnerability allows a crafted app to monitor user actions across arbitrary apps by accessing an IOKit framework interface, due to insufficient access controls in IOKit. Apple addressed this in iOS 7.1 (patch link...

CVE-2013-2085: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

PT-2014-2444

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description The issue allows remote attackers to hijack user authentication for various requests. This includes changing the timezone via the lat and lng parameters to...

CVE-2013-0297: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 sitename or 2 siteurl parameter to apps/external/ajax/setsites.php...

PT-2014-2545

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.6 Description The issue allows remote authenticated users to access arbitrary files. This is achieved by utilizing a .. dot dot in the dir parameter of the apps/files trashbin/index.php file, which enables...

CVE-2013-0299: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the timezone for the user via the lat and lng parameters to...

CVE-2013-0301: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter...

CVE-2013-2041: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tag parameter to apps/bookmarks/ajax/addBookmark.php or 2 dir parameter to apps/files/ajax/newfile.php, which is passed to...

CVE-2013-2042: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to 1 apps/bookmarks/ajax/addBookmark.php or 2 apps/bookmarks/ajax/editBookmark.php...

PT-2014-2446

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 Description A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for requests that change the timezone via the timezone parameter in the...

PT-2014-2504

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.13 ownCloud versions 4.5.x prior to 4.5.8 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file due to multiple incomplete blacklist vulnerabilities i...

PT-2014-2536

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.11 ownCloud versions 5.x prior to 5.0.6 Description The issue allows remote authenticated users to download arbitrary calendars due to improper ownership checking of a calendar. This is achieved via the calendar ...

CVE-2013-1850: Improper Control of Generation of Code

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

CVE-2013-0300: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary 2 Google Drive or 3 Dropbox...