CVE-2012-5336

lib/base.php in ownCloud before 4.0.8 does not properly validate the userid session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV...

CVE-2012-5336

The CVE-2012-5336 issue affects ownCloud Server versions prior to 4.0.8. The root cause is improper validation of the user_id session variable in lib/base.php, which allows remote authenticated users to read arbitrary files via WebDAV. Affected software: ownCloud Server

CVE-2014-3835

The CVE-2014-3835 entry concerns ownCloud Server where the files_external application does not properly check user permissions. Affected are ownCloud Server < 5.0.16 and

CVE-2012-5056

OwnCloud Server prior to 4.0.8 is affected by multiple XSS vulnerabilities. The issues allow remote attackers to inject arbitrary script/HTML via three vectors: (1) readyCallback in apps/files_odfviewer/src/webodf/webodf/flashput/PUT.swf, (2) root parameter to apps/gallery/templates/index.php, an...

CVE-2013-1941

The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-2056

CVE-2014-2056 affects ownCloud Server via the PHPDocX library. Affected: ownCloud Server < 5.0.15 and

CVE-2014-3837

Affected software: ownCloud Server prior to 6.0.3. Vulnerability: the file_id in the documents app is auto-incremented, enabling remote authenticated users to enumerate shared files. Root cause: sequential file_id values used instead of a random access token. Impact: authenticated users could enu...

CVE-2014-3832

CVE-2014-3832 is an XSS vulnerability in the Documents component of ownCloud Server 6.0.x before 6.0.3. The issue allows an attacker to inject arbitrary web script or HTML via unspecified vectors, with the root cause possibly related to the print_unescaped function. Public references indicate aff...

CVE-2014-3835

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

CVE-2014-3836

ownCloud Server

Deserialization of Untrusted Data in core - ownCloud

Due to the deserialization of unstrusted data in core an attacker might be able to delete arbitrary files from the filesystem or executing arbitrary SQL queries. This issue has been found in a widely used third-party library, we have removed the component due to general quality concerns from the...

Improper authorization checks in core - ownCloud

Due to an improper authorization check in core an attacker with access to at least two user account is able to access the file names of other users. Our post-mortem audit showed that this vulnerability does not leak any content of the file or the directory structure except the filename. Affected...

Enumeration of shared files in documents - ownCloud

Due to using the auto-incrementing fileid instead of the random generated token to access files in the documents app an authenticated users could enumerate shared files of other users. Affected Software ownCloud Server 6.0.3 CVE-2014-3837 Action Taken We replaced the usage of fileid with our rand...

CSRF in documents - ownCloud

Due to not verifying whether a request was intentionally provided by the user who submitted an request the documents application is vulnerable against several CSRF attacks. An attacker could have used this to arbitrary modify existing files or rename it. Affected Software ownCloud Server 6.0.3...

Improper authorization checks in files_external - ownCloud

Due to not verifying whether an user has been granted access to add external storages an authenticated user could even mount external storage e.g. SMB/FTP/etc. without permission. Affected Software ownCloud Server 6.0.3 CVE-2014-3835 ownCloud Server 5.0.16 CVE-2014-3835 Action Taken We reviewed t...

Improper authorization checks in contacts - ownCloud

Due to not verifying whether an user has been granted access to an address book, authenticated users are able to access arbitrary contacts of other users. Affected Software ownCloud Server 6.0.3 CVE-2014-3834 Action Taken We reviewed the access-control of the contacts application and ensured that...

Mandriva Linux Security Advisory : owncloud (MDVSA-2014:101)

Updated owncloud packages fix security vulnerabilities : Owncloud versions 5.0.16 and 6.0.3 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Fedora Update for owncloud FEDORA-2014-5918

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : owncloud-6.0.3-1.fc20 (2014-5918)

bugfix release 6.0.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] Fedora 20 Update: owncloud-6.0.3-1.fc20

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...