CVE-2014-3833

CVE-2014-3833 affects ownCloud Server: multiple XSS flaws in Gallery and core components, exploitable in versions prior to 5.0.16 and 6.0.x prior to 6.0.3, potentially linked to print_unescaped. The connected advisories/entries confirm affected ranges and provide an official remediation path: upg...

CVE-2014-2055

SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2014-2053

CVE-2014-2053 concerns getID3()

CVE-2014-3833

Multiple cross-site scripting XSS vulnerabilities in the 1 Gallery and 2 core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the printunescaped function...

CVE-2012-5057

CRLF injection vulnerability in ownCloud Server before 4.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path parameter...

CVE-2012-5057

CVE-2012-5057 describes a CRLF injection vulnerability in ownCloud Server

CVE-2014-2055

SabreDAV vulnerability (CVE-2014-2055) affects SabreDAV <= 1.7.10 used within ownCloud Server <= 6.0.x (before 6.0.2) and = 5.0.15 or >= 6.0.2) where fixes are implemented. If exploitation details are not provided in the documents, they are not assumed; only the explicit XXE risk and aff...

CVE-2014-2055

SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2014-2054

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2014-3963

Consolidated details: CVE-2014-3963 affects ownCloud Server before 6.0.1. The root cause is an improper permissions check, enabling remote authenticated users to access arbitrary preview pictures via unspecified vectors. The vulnerability impacts preview access and does not indicate remote code e...

CVE-2012-5056

OwnCloud Server prior to 4.0.8 is affected by multiple XSS vulnerabilities. The issues allow remote attackers to inject arbitrary script/HTML via three vectors: (1) readyCallback in apps/files_odfviewer/src/webodf/webodf/flashput/PUT.swf, (2) root parameter to apps/gallery/templates/index.php, an...

CVE-2014-3838

Summary (Concrete details from provided documents): The CVE-2014-3838 issue affects ownCloud Server before 5.0.16 and 6.0.x before 6.0.3. The root cause is improper authorization checks in the core, allowing remote authenticated users with access to multiple accounts to read the names of files be...

CVE-2014-3832

CVE-2014-3832 is an XSS vulnerability in the Documents component of ownCloud Server 6.0.x before 6.0.3. The issue allows an attacker to inject arbitrary web script or HTML via unspecified vectors, with the root cause possibly related to the print_unescaped function. Public references indicate aff...

CVE-2014-3836

ownCloud Server

CVE-2014-3835

The CVE-2014-3835 entry concerns ownCloud Server where the files_external application does not properly check user permissions. Affected are ownCloud Server < 5.0.16 and

ownCloud Multiple Cross-Site Scripting & Directory Traversal Vulnerabilities

ownCloud is prone to session fixation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if...

ownCloud 'contacts' Security Bypass Vulnerability (May 2014)

ownCloud is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if...

UBUNTU-CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

Directory traversal

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...