CVE-2015-5953

The CVE-2015-5953 issue is an XSS vulnerability in the ownCloud Server activity module, exploitable by an authenticated remote user via a double-quote character in a filename in a shared folder. Affected are ownCloud Server versions prior to 7.0.5 and 8.0.x prior to 8.0.4. The problem is describe...

Debian DSA-3373-1 : owncloud - security update

Multiple vulnerabilities were discovered in ownCloud, a cloud storage web service for files, music, contacts, calendars and many more. These flaws may lead to the execution of arbitrary code, authorization bypass, information disclosure, cross-site scripting or denial of service. %NASLMINLEVEL...

[SECURITY] [DSA 3373-1] owncloud security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3373-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 18, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3373-1] owncloud security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3373-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 18, 2015 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3373-1 (owncloud - security update)

Multiple vulnerabilities were discovered in ownCloud, a cloud storage web service for files, music, contacts, calendars and many more. These flaws may lead to the execution of arbitrary code, authorization bypass, information disclosure, cross-site scripting or denial of service. OpenVAS...

DSA-3373-1 owncloud - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3373-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2015-0378)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2015-0256)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2015-0314)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ownCloud: apps.owncloud.com: Referer protection Bypassed

@herlove has reported a vulnerability within the appstore at apps.owncloud.com allowing an adversary to bypass the HTTP referer based CSRF protection. This issue was caused by an insufficient regular expression which has been patched meanwhile. On request of the reporter this issue has been...

ownCloud: Self-XSS in mails sent by [email protected]

Hello i create account with username have a payload code "alert1, and i always when i get mail from [email protected] i get mail win inject the code payload html code inject From: ownCloud Reply-To: [email protected] To: [email protected] Message-ID: Subject: ownCloud Security & Encryption 2.0; A...

PHP arbitrary class instantiation in "files_external" - ownCloud

A user may instantiate arbitrary ownCloud classes due to a lack of a proper check of the mount point options provided by a user via the web front end. These may include constructor arguments and could potentially lead to a remote code execution. Affected Software ownCloud Server 8.1.2 CVE-2015-76...

Command injection when using external SMB storage - ownCloud

The external legacy SMB storage not using php-libsmbclient of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. Effectively this allows an attacker to gain access to any file on the system or overwrite it, potentially leading ...

Server: Command injection when using external SMB storage

The external legacy SMB storage not using php-libsmbclient of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. Effectively this allows an attacker to gain access to any file on the system or overwrite it, potentially leading ...

Server: PHP arbitrary class instantiation in "files_external"

A user may instantiate arbitrary ownCloud classes due to a lack of a proper check of the mount point options provided by a user via the web front end. These may include constructor arguments and could potentially lead to a remote code execution. For more information please consult the official...

ownCloud: owncloud.com: WP Super Cache plugin is outdated

I know it might be out of scope, but I report it to be sure https://owncloud.org/wp-content/plugins/wp-super-cache/readme.txt shows version 1.4.4 and this version is prone to XSS and PHP Object injection http://z9.io/2015/09/25/wp-super-cache-1-4-5/...

ownCloud: No email verification during registration

When you register for a new account, there is no verification link sent to the email for confirmation. The account is directly activated and can be used without confirming the email. This is vulnerable as anyone can use anyone's email without verification. and one with valid email owner cant sign...

ownCloud: [s3.owncloud.com] Web Server HTTP Trace/Track Method Support

Hello. Not ineresting bug but you can fixed it as in 83837. https://hackerone.com/reports/83837 Request: TRACE /gxDM8DATHA HTTP/1.1 Host: s3.owncloud.com Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.21 KHTML, like Gecko...

ownCloud Information Disclosure Vulnerability (CNVD-2015-06359)

ownCloud is an open source personal cloud storage solution. An information disclosure vulnerability exists in ownCloud, allowing remote attackers to exploit the vulnerability to obtain sensitive information...