CVE-2015-7298

ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle MITM attacks by leveraging a server using a self-signed...

CVE-2015-7298

ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle MITM attacks by leveraging a server using a self-signed...

CVE-2015-4456

ownCloud Desktop Client before 1.8.2 does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which allows man-in-the-middle attackers to bypass the user's certificate distrust decision and obtain sensitive information by leveraging a self-signed certificate and a...

CVE-2015-6670

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php...

CVE-2015-7298

CVE-2015-7298 affects the ownCloud Desktop Client prior to 2.0.1 when built with a Qt release after 5.3.x. The issue is that the client does not call QNetworkReply::ignoreSslErrors with the list of errors to ignore, which can enable remote attackers to perform MITM attacks against servers using s...

CVE-2015-6500

Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service CPU consumption via a .. dot dot in the dir parameter to index.php/apps/files/ajax/scan.php...

ownCloud Server Arbitrary Command Execution Vulnerability

ownCloud is a free and open source personal cloud storage solution created by Frank Karlitschek, a German KDE developer. ownCloud Server is a server version . A security vulnerability exists in the external legacy SMB storage feature of ownCloud Server versions prior to 8.1.2, which can be...

[SECURITY] [DSA 3373-1] owncloud security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3373-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 18, 2015 https://www.debian.org/security/faq...

[SECURITY] [DSA 3363-1] owncloud-client security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3363-1 [email protected] https://www.debian.org/security/ Luciano Bello September 20, 2015 https://www.debian.org/security/faq...

owncloud multiple security vulnerabilities

Code execution, authentication bypass, information disclosure, crossite scripting, DoS...

owncloud client server spoofing

Server certificate spoofing is possible...

ownCloud Server Restriction Bypass Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek; ownCloud Server is a server edition. A security restriction bypass vulnerability exists in ownCloud Server versions prior to 6.0.9, 8.0.x prior to 8.0.5, and 7.0.x prior to...

ownCloud Server Directory Traversal Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek; ownCloud Server is a server edition. A directory traversal vulnerability exists in ownCloud Server versions prior to 7.0.6, and 8.0.4 prior to 8.0.x. The vulnerability is...

ownCloud Server Arbitrary SMB Command Execution Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek; ownCloud Server is a server edition. An arbitrary SMB command execution vulnerability exists in ownCloud Server versions prior to 6.0.8, 8.0.4 prior to 8.0.x, and 7.0.6 pri...

ownCloud Server Denial of Service Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek; ownCloud Server is a server edition. A denial of service vulnerability exists in ownCloud Server versions prior to 6.0.8, 8.0.x versions prior to 8.0.4 and 7.0.x versions...

ownCloud Server Cross-Site Scripting Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek. ownCloud Server is a server version. A cross-site scripting vulnerability exists in ownCloud Server versions prior to 7.0.5 and 8.0.4 and prior to 8.0.x. The vulnerability...

CVE-2015-5954

The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a fil...

CVE-2015-4718

The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; semicolon character in a file...

CVE-2015-4717

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

CVE-2015-4716

Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors...