EUVD-2014-8870

Malware in sbrugna...

Cross site request forgery (csrf)

The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks...

PT-2015-4135

Name of the Vulnerable Software and Affected Versions ownCloud server versions prior to 5.0.18 ownCloud server versions 6.x prior to 6.0.6 ownCloud server versions 7.x prior to 7.0.3 Description The issue concerns the import functionality in the bookmarks application, which fails to validate CSRF...

CVE-2014-9042: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this c...

PT-2015-4136

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.18 ownCloud versions 6.x prior to 6.0.6 ownCloud versions 7.x prior to 7.0.3 Description The issue is related to a cross-site scripting XSS vulnerability in the import functionality of the bookmarks application...

CSRF in "bookmarks" application - ownCloud

Due to not verifying the CSRF token on the import functionality of the "bookmarks" application, it was vulnerable against CSRF attacks. The "bookmarks" application is disabled by default. An unauthenticated attacker could have used this to import bookmarks into the "bookmarks" application if the...

Server: Stored XSS in "bookmarks" application

Due to not sanitising all user provided input, the "bookmarks" application shipped with the below mentioned ownCloud versions is vulnerable to a stored Cross-site scripting attack. The "bookmarks" application is disabled by default. Abusing this vulnerability requires the user to import a malicio...

Server: CSRF in "bookmarks" application

Due to not verifying the CSRF token on the import functionality of the "bookmarks" application, it was vulnerable against CSRF attacks. The "bookmarks" application is disabled by default. An unauthenticated attacker could have used this to import bookmarks into the "bookmarks" application if the...