Credentials potentially leaked to other configured ownCloud instance

A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances...

ownCloud Desktop Client Security Bypass Vulnerability

ownCloud is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek. The solution offers file management, music storage, calendars, and more. A security vulnerability exists in ownCloud Desktop Client due to the application failing to properly...

Updated owncloud-client package fixes security vulnerability

ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...

MGASA-2015-0256 Updated owncloud-client package fixes security vulnerability

ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...

Stored XSS in "activity" application - ownCloud

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

Command injection when using external SMB storage - ownCloud

The external SMB storage of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. This was caused by improperly sanitizing the ; character which is interpreted as command separator by smbclient the used software to connect to SMB...

Resource Exthaustion when sanitizing filenames - ownCloud

The sanitization component for filenames was vulnerable to DoS when parsing specially crafted file names passed via specific endpoints. Effectively this lead to a endless loop filling the log file until the system is not anymore responsive. Affected Software ownCloud Server 6.0.8 CVE-2015-4717...

Local file inclusion on MS Windows Platform - ownCloud

Due to an improper control of the filename for a requireonce statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions when running on the MS Windows Platform. Depending on the ownCloud configuration and the authentication...

Mounted Dropbox storage allows "Dropbox.com" to access any file - ownCloud

A bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted. This was caused by a feature of PHP which has been turned off per default as of PHP 5.6.0 in t...

Server: Command injection when using external SMB storage

The external SMB storage of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. This was caused by improperly sanitizing the ; character which is interpreted as command separator by smbclient the used software to connect to SMB...

Server: Local file inclusion on MS Windows Platform

Due to an improper control of the filename for a requireonce statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions when running on the MS Windows Platform. Depending on the ownCloud configuration and the authentication...

Server: Mounted Dropbox storage allows "Dropbox.com" to access any file

A bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted. This was caused by a feature of PHP which has been turned off per default as of PHP 5.6.0 in t...

Desktop Client: Improper validation of certificates when using self-signed certificates

The ownCloud Desktop Client was vulnerable against MITM attacks until version 1.8.2 in combination with self-signed certificates. To be exploitable the following conditions have to be met: The connection to the remote ownCloud server must be secured using a self-signed certificate which the user...

Improper validation of certificates when using self-signed certificates - ownCloud

The ownCloud Desktop Client was vulnerable against MITM attacks until version 1.8.2 in combination with self-signed certificates. To be exploitable the following conditions have to be met: The connection to the remote ownCloud server must be secured using a self-signed certificate which the user...

ownCloud Server Arbitrary File Upload Vulnerability

ownCloud is an open source private cloud server. The ownCloud Server has a security vulnerability that allows authenticated users to bypass the file blacklist list and upload arbitrary files, such as .htaccess files, via UTF-8 encoded file paths...

ownCloud Server Contact Application Cross-Site Scripting Vulnerability

ownCloud is an open source private cloud server. ownCloud Server has multiple cross-site scripting vulnerabilities that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform...

CVE-2015-3013

ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file...

CVE-2015-3012

Multiple cross-site scripting XSS vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a 1 style or 2 font name or 3 javascript or 4 data URI...

CVE-2015-3011

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...

CVE-2015-3011

Multiple cross-site scripting XSS vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact...