1965 matches found
ownCloud: apps.owncloud.com: Path Disclosure
Threat: A potentially sensitive file, directory, or directory listing was discovered on the Web server. Impact: The contents of this file or directory may disclose sensitive information. Solution: Verify that access to this file or directory is permitted. If necessary, remove it or apply access...
ownCloud: apps.owncloud.com: Session Cookie in URL can be captured by hackers
Session Cookie in URL URL: https://apps.owncloud.com/stories/feed+rss Issue detail The URL in the request appears to contain a PHP Session token within the query string: https://apps.owncloud.com/stories/feed+rss?id=42590&PHPSESSID=ee0624300266683a4625aabea344212a Issue background Sensitive...
ownCloud: owncloud.com: PermError SPF Permanent Error: Too many DNS lookups
I just checked for SPF records for the owncloud.com domain, and there are none, effectively allowing for spamspoof to originate from that domain. you can validate by testing yourself here: http://www.kitterman.com/spf/validate.html SPF record lookup and validation for: owncloud.com SPF records ar...
ownCloud: apps.owncloud.com: Multiple reflected XSS by insecure URL generation (IE only)
Due to a bug in the URL generation component mainly used by forms on the ownCloud appstore available at apps.owncloud.com is vulnerable to multiple reflected XSS. This problem seems only to be exploitable in Internet Explorer since other browsers are URL encoding GET parameters. This was...
ownCloud: owncloud.com: Cross Site Tracing
REQUEST: TRACE / HTTP/1.0 Host: owncloud.com Cookie: 74b33b43fa RESPONSE: HTTP/1.1 200 OK Date: Wed, 19 Aug 2015 06:59:31 GMT Server: Apache/2.2.17 Linux/SUSE Connection: close Content-Type: message/http TRACE / HTTP/1.0 Host: owncloud.com Cookie: 74b33b43fa; wordpresstestcookie=WP+Cookie+check;...
ownCloud: owncloud.com: Content Sniffing not disabled
URL :- https://owncloud.com Issue description :- There was no "X-Content-Type-Options" HTTP header with the value nosniff set in the response. The lack of this header causes that certain browsers, try to determine the content type and encoding of the response even when these properties are define...
ownCloud: owncloud.com: Allowed an attacker to force a user to change profile details. (XCSRF)
Allowed an attacker to force a user to change profile details. XCSRF A CSRF attack would not be prevented by this countermeasure because the attacker forges a request through the user's web browser in which a valid session already exists. There is no mitigation of Cross-Site Request Forgery XCSRF...
ownCloud: owncloud.com: DOM Based XSS
Hello, there's DOM Based XSS In Main Page https://owncloud.com/"// Thanks...
MGASA-2015-0314 Updated owncloud package fixes security vulnerabilities
In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted CVE-2015-4715. In ownCloud before 6.0.8 and 8.0.4, the...
Updated owncloud package fixes security vulnerabilities
In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted CVE-2015-4715. In ownCloud before 6.0.8 and 8.0.4, the...
ownCloud for iOS Information Disclosure Vulnerability
ownCloud for iOS is a free and open source personal cloud storage solution based on the iOS platform created by German KDE developer Frank Karlitschek. The program offers file management, music storage, calendars, and more. An information disclosure vulnerability exists in ownCloud for iOS. An...
ownCloud for iOS Security Bypass Vulnerability
ownCloud for iOS is a free and open source personal cloud storage solution based on the iOS platform created by German KDE developer Frank Karlitschek. The program offers file management, music storage, calendars, and more. A security bypass vulnerability exists in ownCloud for iOS. An attacker c...
Disclosure of users files when deleting parent folders of shared files - ownCloud
Due to a common incorrect usage of the getPath function of the ownCloud virtual filesystem multiple security issues occurred. Especially the function may return null in case the specified file does not exist anymore. When passing the result of getPath in combination with null to functions that...
Server: Stored XSS in "activity" application
Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...
Server: Disclosure of users files when deleting parent folders of shared files
Due to a common incorrect usage of the getPath function of the ownCloud virtual filesystem multiple security issues occurred. Especially the function may return null in case the specified file does not exist anymore. When passing the result of getPath in combination with null to functions that...
Mobile App: Credentials potentially leaked to other configured ownCloud instance
A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances. Specifically, the ownCloud iOS application allows users to connect to multiple ownCloud instances offering an easy way to swit...
Credentials potentially leaked to other configured ownCloud instance - ownCloud
A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances. Specifically, the ownCloud iOS application allows users to connect to multiple ownCloud instances offering an easy way to swit...
Credentials potentially leaked to other configured ownCloud instance
A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances...
ownCloud Desktop Client Security Bypass Vulnerability
ownCloud is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek. The solution offers file management, music storage, calendars, and more. A security vulnerability exists in ownCloud Desktop Client due to the application failing to properly...
Updated owncloud-client package fixes security vulnerability
ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...