Design/Logic Flaw

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

Information disclosure

Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack...

Design/Logic Flaw

The OCUtil::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol...

Authentication flaw

The FTP backend in userexternal in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password...

CVE-2014-9045

Summary: CVE-2014-9045 affects the ownCloud Server FTP backend in the external user_External backend. The flaw arises because the FTP backend did not URL-encode credentials, allowing a remote attacker to bypass authentication with a crafted password. Affected versions (per sources): ownCloud Serv...

CVE-2014-9041

The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks...

CVE-2014-9042

Cross-site scripting XSS vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this c...

CVE-2014-9047

CVE-2014-9047 affects ownCloud 6.x before 6.0.6 and 7.x before 7.0.3. The vulnerability is a local file disclosure via the preview system, enabling reading arbitrary files through unknown vectors. Multiple connected sources (NVD entry and ownCloud security advisory) confirm the affected versions ...

CVE-2014-9044

Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack...

CVE-2014-9042

CVE-2014-9042 is an XSS in the import functionality of the ownCloud bookmarks app, affecting versions prior to 5.0.18, 6.x prior to 6.0.6, and 7.x prior to 7.0.3. The vulnerability allows remote authenticated users to inject arbitrary script/HTML by importing a link with an unspecified protocol. ...

CVE-2014-9047

Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via unknown vectors...

CVE-2014-9044

CVE-2014-9044 relates to ownCloud 7.x prior to 7.0.3, where the Asset Pipeline names the concatenated CSS/JS blob using an MD5 hash of the absolute file paths. This allowed an attacker to brute-force disclose the install path (e.g., /var/www/owncloud/). The root cause is the use of absolute paths...

CVE-2014-5341

The CVE-2014-5341 issue affects the ownCloud Server SFTP external storage driver (files_external) prior to version 6.0.5. The root cause is improper RSA host key validation after login, enabling potential information disclosure via network sniffing (MITM-like exposure). Exploitation details are s...

CVE-2014-5341

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-9046

The OCUtil::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol...

CVE-2014-9043

CVE-2014-9043 affects ownCloud’s user_ldap backend: a null byte in the password with a valid username enables an unauthenticated bind, bypassing authentication. Affected are ownCloud releases prior to 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3. Multiple sources (SUSE/Mandriva advisories and C...

CVE-2014-9049

The CVE-2014-9049 entry concerns ownCloud Server’s Documents application. Affected are ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3. The root issue is a legacy debugging/API method that allowed remote authenticated users to obtain all valid session IDs, enabling access to resources tied ...

CVE-2014-9041

The CVE-2014-9041 entry concerns ownCloud bookmarks import functionality lacking CSRF token validation. Affected versions: server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3. Root cause: missing CSRF protection in the import flow, enabling CSRF attacks from remote attackers. Reported im...

CVE-2014-9048

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API...

CVE-2014-9048

The CVE-2014-9048 entry concerns ownCloud Server’s documents application, where the vulnerability arises from missing access control in the API. Affected versions are ownCloud Server < 6.0.6 (i.e., 6.x prior to 6.0.6) and