404 matches found
Path traversal
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...
CVE-2021-35947
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...
CVE-2021-35948
CVE-2021-35948 affects ownCloud Server prior to 10.8.0. The vulnerability is a session-fixation issue where an attacker can force a target client to use a controlled cookie, allowing bypass of password protection on public links. Affected component: ownCloud Server public links/session handling. ...
CVE-2021-35948
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie...
CVE-2021-35949
The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share...
CVE-2021-35949
CVE-2021-35949 affects the shareinfo controller in ownCloud Server prior to 10.8.0, enabling an attacker to bypass upload-only share permission checks and enumerate share metadata via a network-based, low-complexity path with no authentication. A fix is available in 10.8.0 and later; upgrading to...
CVE-2021-35947
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...
PT-2021-21074
Name of the Vulnerable Software and Affected Versions: ownCloud Server versions prior to 10.8.0 Description: The issue allows an attacker to bypass password protection on public links by forcing a target client to use a controlled cookie, specifically through session fixation. Recommendations: Fo...
CVE-2021-35948: Session Fixation
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie...
CVE-2021-35949: Incorrect Authorization
The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share...
Owncloud ownCloud 权限许可和访问控制问题漏洞
Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. The ownCloud Server suffers from a Privilege License and Access Control Issue vulnerability that stems from the ability of a federated share recipient to increase privileges, which can lead to bypassing...
ownCloud 安全漏洞
ownCloud is a personal cloud storage solution from US-based ownCloud. A security vulnerability exists in ownCloud Server, which can be exploited by an attacker to gain unauthorized access to sensitive system information...
CVE-2020-36249
The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...
CVE-2020-36252
ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number...
CVE-2020-36251
ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...
Design/Logic Flaw
The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...
CVE-2020-36249
The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...
CVE-2020-36249
The CVE-2020-36249 case concerns OwnCloud File Firewall (pre-2.8.0) failing to enforce file-type restrictions on public shares. Affected product is ownCloud Server’s File Firewall component; the root cause is described as improper enforcement of shared-file type restrictions. Public shares could ...
CVE-2020-36251
Summary (supported by provided documents): CVE-2020-36251 affects OwnCloud Server and concerns a permissions/access control issue in group shares. Specifically, as described in the CVE, an attacker who already has non-administrative access to a group share can remove everyone else’s access to tha...