CVE-2015-4717

CVE-2015-4717 affects ownCloud Server: the filename sanitization component fails to properly handle $_GET parameters cast to an array, allowing remote attackers to trigger a denial of service (infinite loop and log file consumption) via crafted endpoint file names. Affected versions are before 6....

Cross site scripting

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-5953

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-4718: Improper Neutralization of Special Elements used in an OS Command

The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; semicolon character in a file...

CVE-2015-5953: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-4716: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors...

CVE-2015-5954: Undefined Security Weakness

The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a fil...

CVE-2015-4717: Undefined Security Weakness

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

PT-2015-2578

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 7.0.9 ownCloud Server versions 8.0.x prior to 8.0.7 ownCloud Server versions 8.1.x prior to 8.1.2 Description The issue allows remote authenticated users to possibly execute arbitrary code via a crafted mount...

PT-2015-2461

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.9 ownCloud Server versions 7.0.x prior to 7.0.7 ownCloud Server versions 8.0.x prior to 8.0.5 Description The virtual filesystem in ownCloud Server does not consider that NULL is a valid getPath return...

PT-2015-2573

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 7.0.0 through 7.0.6 ownCloud Server versions 8.0.0 through 8.0.4 Description The issue is related to a directory traversal vulnerability in the routing component of ownCloud Server. This vulnerability allows remote...

PT-2015-2462

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 7.0.5 ownCloud Server versions 8.0.x prior to 8.0.4 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a double quote character in a filename in a shared folder...

PT-2015-2580

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 7.0.8 ownCloud Server versions 8.0.x prior to 8.0.6 ownCloud Server versions 8.1.x prior to 8.1.1 Description The issue is related to improper ownership checking of calendars, allowing remote authenticated use...

PT-2015-2581

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 8.0.6 ownCloud Server versions 8.1.x prior to 8.1.1 Description The issue allows remote authenticated users to list directory contents and possibly cause a denial of service via a .. dot dot in the dir paramet...

ownCloud Server Contact Application Cross-Site Scripting Vulnerability

ownCloud is an open source private cloud server. ownCloud Server has multiple cross-site scripting vulnerabilities that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform...

ownCloud Server Arbitrary File Upload Vulnerability

ownCloud is an open source private cloud server. The ownCloud Server has a security vulnerability that allows authenticated users to bypass the file blacklist list and upload arbitrary files, such as .htaccess files, via UTF-8 encoded file paths...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...

CVE-2015-3013

ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...

Design/Logic Flaw

ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...

CVE-2015-3011

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...