CVE-2015-3011

CVE-2015-3011 is an XSS in ownCloud’s contacts app (Community Edition) allowing remote authenticated users to inject script/HTML via crafted contacts. Affected: ownCloud Server 5.0.19 and 6.x/7.x before specific fixes. Remediation: upgrade to patched packages (e.g., Debian/DSA-3244-1 fixes). Note...

CVE-2015-3011

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...

CVE-2015-3013

The CVE-2015-3013 entry applies to ownCloud Server releases before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5, where authenticated remote users could bypass the file blacklist and upload arbitrary files by using UTF-8 encoded paths (demonstrated with .htaccess). Exploitation requires authenti...

CVE-2015-3011: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...

CVE-2015-3013: Improper Neutralization of Special Elements in Output Used by a Downstream Component

ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...

ownCloud Asset Pipeline Feature Remote Path Disclosure Vulnerability (oC-SA-2014-021)

ownCloud is prone to a path disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

CVE-2014-9046

The OCUtil::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol...

CVE-2014-9045

The FTP backend in userexternal in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password...

Cross site request forgery (csrf)

The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks...

CVE-2014-5341

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

Design/Logic Flaw

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-5341

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-9046

The CVE-2014-9046 case affects ownCloud Server: OC_Util::getUrlContent() can be abused to read arbitrary local files via file:// redirects in affected releases (ownCloud Server < 5.0.18, 6.x < 6.0.6, 7.x

CVE-2014-9045

Summary: CVE-2014-9045 affects the ownCloud Server FTP backend in the external user_External backend. The flaw arises because the FTP backend did not URL-encode credentials, allowing a remote attacker to bypass authentication with a crafted password. Affected versions (per sources): ownCloud Serv...

CVE-2014-9045: Improper Authentication

The FTP backend in userexternal in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password...

CVE-2014-9046: Exposure of Sensitive Information to an Unauthorized Actor

The OCUtil::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol...

CVE-2014-9049: Exposure of Sensitive Information to an Unauthorized Actor

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method...

CVE-2014-9048: Undefined Security Weakness

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API...

CVE-2014-5341: Exposure of Sensitive Information to an Unauthorized Actor

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

Directory traversal

Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in a filename, related to index.php...