CVE-2013-2085

CVE-2013-2085: ownCloud Server directory traversal via apps/files_trashbin/index.php (dir parameter). Affected: ownCloud Server prior to 5.0.6; vulnerability allows remote authenticated users to access arbitrary local files. Root cause: improper handling of .. in dir parameter enabling directory ...

CVE-2013-2041

Vulnerability summary (CVE-2013-2041) : ownCloud 5.0.x is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to inject arbitrary web script or HTML. The flaw is triggered by unescaped user-provided input in two locations: (1) the tag parameter to...

CVE-2013-2039

CVE-2013-2039 affects ownCloud: directory traversal in lib/files/view.php allows remote authenticated users to access arbitrary files. Vulnerable versions: < 4.0.15, < 4.5.11 for the 4.5.x line, and

CVE-2013-1851

CVE-2013-1851 affects ownCloud server via an incomplete blacklist in lib/migrate.php. Affected versions are before 4.0.13 and before 4.5.8 (4.5.x). When user_migrate is enabled, remote authenticated users can import arbitrary files into their own account via unspecified vectors. Root cause is imp...

CVE-2013-1850

CVE-2013-1850 affects ownCloud Server prior to 4.0.13 and prior to 4.5.8 (4.5.x). The vulnerability is an incomplete blacklist in apps/contacts/import.php and apps/contacts/ajax/uploadimport.php that allows authenticated remote users to upload a .htaccess file and thereby achieve arbitrary PHP co...

CVE-2013-1822

ownCloud 4.5.x before 4.5.8 is affected by multiple XSS vulnerabilities (CVE-2013-1822). The flaws allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via (1) quota parameter to /core/settings/ajax/setquota.php, (2) group field to settings.php, or...

CVE-2013-2150

Multiple cross-site scripting XSS vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files...

CVE-2013-2040

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2044

The CVE-2013-2044 issue affects ownCloud Server prior to version 5.0.6, where the login page (index.php) allows an Open Redirect via the redirect_url parameter. This can enable attackers to redirect users to arbitrary sites and facilitate phishing attacks. The vulnerability is documented in offic...

CVE-2013-2044

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2013-2149

CVE-2013-2149: ownCloud is vulnerable to cross-site scripting via shared files. Mageia MGASA-2013-0171 notes XSS in js/viewer.js and core/js/oc-dialogs.js, exploitable in all ownCloud versions before 5.0.7 and 4.0.16. Affected components include files_videoviewer; impact is arbitrary script injec...

CVE-2013-2047

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

CVE-2013-2043

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendarid parameter...

CVE-2013-2048

ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands...

CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-2086

The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file...

CVE-2013-1850

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

CVE-2013-2048

The CVE-2013-2048 issue affects ownCloud Server prior to 5.0.6, where an insufficient permission check allows authenticated users to execute arbitrary API commands via unspecified vectors, with CSRF enabling remote command execution. The root cause is an inadequate access-control check on API com...

CVE-2013-1939

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ backslash character...

CVE-2013-2043

CVE-2013-2043 affects ownCloud calendar handling: the script apps/calendar/ajax/events.php fails to properly verify calendar ownership, enabling remote authenticated users to download arbitrary calendars via the calendar_id parameter. Affected versions are ownCloud before 4.5.11 and 5.x before 5....