CVE-2013-2045

CVE-2013-2045 affects ownCloud Server prior to 5.0.6 (and related advisory notes) where lib/db.php does not neutralize special elements passed to SQL queries, enabling SQL injection by remote authenticated users. The issue is limited to authenticated access and the impact is described as arbitrar...

CVE-2013-1890

CVE-2013-1890 affects ownCloud Server versions before 5.0.1, with multiple XSS vulnerabilities exploitable via (1) the new_name parameter to apps/bookmarks/ajax/renameTag.php and (2) multiple unspecified parameters to files in apps/contacts/ajax/. The underlying issue is cross-site scripting that...

MGASA-2014-0120 Updated owncloud packages fix security vulnerabilities and bugs

Updated owncloud packages fix security vulnerabilities: Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information...

Updated owncloud packages fix security vulnerabilities and bugs

Updated owncloud packages fix security vulnerabilities: Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information...

ownCloud 4.0.x / 4.5.x Remote Code Execution

Vulnerability title: Remote Code Execution in ownCloud CVE: CVE-2014-2044 Vendor: ownCloud Product: ownCloud Affected version: 4.0.x & 4.5.x Fixed version: 5.0 Reported by: Alejo Murillo Moya Details: A remote code execution has been found and confirmed within ownCloud as an authenticated user. A...

ownCloud 6.0.0a File Deletion / XSS / CSRF

Exploit Title: ownCloud 6.0.0a File Deletion XSS and CSRF Protection Bypass Vendor Homepage: www.ownCloud.org OwnCloud Version: 6.0.0a Browsers tested: Iceweasel 22.0; Internet Explorer 11; Server: Debian. Default LAMP set-up. Exploit Author: James Sibley absane Blog: http://blog.noobroot.com...

CVE-2013-1967

Cross-site scripting XSS vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2013-1967

Cross-site scripting XSS vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2013-1967

CVE-2013-1967 describes a Cross-site scripting (XSS) vulnerability in flashmediaelement.swf used by MediaElement.js before 2.11.2. The flaw affects ownCloud Server deployments, specifically 5.0.x before 5.0.5 and 4.5.x before 4.5.10, where an attacker can inject arbitrary script or HTML via the f...

ownCloud 6.0.0a - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: ownCloud 6.0.0a File Deletion XSS and CSRF Protection Bypass Vendor Homepage: www.ownCloud.org OwnCloud Version: 6.0.0a Browsers tested: Iceweasel 22.0; Internet Explorer 11; Server: Debian. Default LAMP set-up. Exploit Author:...

ownCloud 6.0.0a - Multiple Vulnerabilities

ownCloud 6.0.0a - Multiple Vulnerabilities Exploit Title: ownCloud 6.0.0a File Deletion XSS and CSRF Protection Bypass Vendor Homepage: www.ownCloud.org OwnCloud Version: 6.0.0a Browsers tested: Iceweasel 22.0; Internet Explorer 11; Server: Debian. Default LAMP set-up. Exploit Author: James Sible...

ownCloud 6.0.0a - Multiple Vulnerabilities

Exploit Title: ownCloud 6.0.0a File Deletion XSS and CSRF Protection Bypass Vendor Homepage: www.ownCloud.org OwnCloud Version: 6.0.0a Browsers tested: Iceweasel 22.0; Internet Explorer 11; Server: Debian. Default LAMP set-up. Exploit Author: James Sibley absane Blog: http://blog.noobroot.com...

[ MDVSA-2013:289 ] owncloud

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:289 http://www.mandriva.com/en/support/security/ Package : owncloud Date : December 17, 2013 Affected: Business Server 1.0 Problem Description: Updated owncloud package fixes security vulnerability: Possible...

CVE-2013-6403

The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB...

CVE-2013-6403

The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB...

Design/Logic Flaw

The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB...

CVE-2013-6403

The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB...

CVE-2013-6403

CVE-2013-6403 affects ownCloud up to 5.x, where the admin page could bypass intended access restrictions due to issues related to MariaDB. The description indicates a remote bypass vulnerability in admin functionality for versions prior to 5.0.13. Connected advisories note a vendor-security updat...

Mandriva Linux Security Advisory : owncloud (MDVSA-2013:289)

Updated owncloud package fixes security vulnerability : Possible security bypass on admin page under certain circumstances and MariaDB CVE-2013-6403. The owncloud package has been updated to version 5.0.13, fixing this and many other issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

MGASA-2013-0367 Updated owncloud package fixes CVE-2013-6403

Updated owncloud package fixes security vulnerability: Possible security bypass on admin page under certain circumstances and MariaDB CVE-2013-6403. The owncloud package has been updated to version 5.0.13, fixing this and many other issues...