CVE-2015-4717

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

Design/Logic Flaw

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

Directory traversal

Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors...

CVE-2015-4716

Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors...

CVE-2015-4718

CVE-2015-4718 affects ownCloud Server’s external SMB storage driver. Affected versions are ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4. The vulnerability allows remote authenticated users to execute arbitrary SMB commands via a semicolon character in a file, enabling ...

CVE-2015-4716

CVE-2015-4716 is a directory traversal vulnerability in ownCloud Server’s routing component affecting Windows deployments; affected versions are before 7.0.6 and 8.0.x before 8.0.4, allowing remote attackers to reinstall the application or execute arbitrary code via unspecified vectors. Debian ad...

CVE-2015-4716

Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors...

CVE-2015-4717

CVE-2015-4717 affects ownCloud Server: the filename sanitization component fails to properly handle $_GET parameters cast to an array, allowing remote attackers to trigger a denial of service (infinite loop and log file consumption) via crafted endpoint file names. Affected versions are before 6....

Cross site scripting

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-5953

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

ownCloud Server Arbitrary File Upload Vulnerability

ownCloud is an open source private cloud server. The ownCloud Server has a security vulnerability that allows authenticated users to bypass the file blacklist list and upload arbitrary files, such as .htaccess files, via UTF-8 encoded file paths...

ownCloud Server Contact Application Cross-Site Scripting Vulnerability

ownCloud is an open source private cloud server. ownCloud Server has multiple cross-site scripting vulnerabilities that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...

CVE-2015-3013

ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...

Design/Logic Flaw

ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...

CVE-2015-3011

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...

CVE-2015-3011

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...

CVE-2015-3011

CVE-2015-3011 is an XSS in ownCloud’s contacts app (Community Edition) allowing remote authenticated users to inject script/HTML via crafted contacts. Affected: ownCloud Server 5.0.19 and 6.x/7.x before specific fixes. Remediation: upgrade to patched packages (e.g., Debian/DSA-3244-1 fixes). Note...

CVE-2015-3013

The CVE-2015-3013 entry applies to ownCloud Server releases before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5, where authenticated remote users could bypass the file blacklist and upload arbitrary files by using UTF-8 encoded paths (demonstrated with .htaccess). Exploitation requires authenti...

ownCloud Asset Pipeline Feature Remote Path Disclosure Vulnerability (oC-SA-2014-021)

ownCloud is prone to a path disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...