CVE-2012-5610

The CVE-2012-5610 entry describes an Incomplete blacklist vulnerability in ownCloud’s lib/filesystem.php, exploitable by remote authenticated users via uploading a file with a specially crafted name. Affected are ownCloud core versions before 4.0.9 and 4.5.x before 4.5.2. The underlying cause is ...

CVE-2012-5608

CVE-2012-5608 describes a cross-site scripting (XSS) vulnerability in ownCloud’s web authentication module. The issue arises in the file path apps/user_webdavauth/settings.php for ownCloud versions 4.5.x prior to 4.5.2, allowing remote attackers to inject arbitrary web script or HTML via arbitrar...

CVE-2012-5607

The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."...

CVE-2012-5609

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file...

CVE-2012-5609

The CVE-2012-5609 issue affects ownCloud prior to 4.5.2, with the vulnerability in lib/migrate.php allowing remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file inside a ZIP. Root cause: incomplete blacklist handling in the upload path. Impact per sources...

CVE-2012-5609

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file...

CVE-2012-5610

Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name...

CVE-2012-5606

OwnCloud contains multiple XSS vulnerabilities in versions before 4.0.9 and 4.5.0. The flaws allow remote injection of arbitrary scripts/HTML via (1) file name in apps/files_versions/js/versions.js, (2) apps/files/js/filelist.js, or (3) event title in 3rdparty/fullcalendar/js/fullcalendar.js. Roo...

CVE-2012-5608

Cross-site scripting XSS vulnerability in apps/userwebdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters...

PT-2012-6056

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.5.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file. This is due to an incomplete blacklist vulnerability in lib/migrate.php...

CVE-2012-5606: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the 1 file name to apps/filesversions/js/versions.js or 2 apps/files/js/filelist.js; or 3 event title to 3rdparty/fullcalendar/js/fullcalendar.js...

CVE-2012-5608: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in apps/userwebdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters...

CVE-2012-5610: Improper Input Validation

Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name...

CVE-2012-5607: Undefined Security Weakness

The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."...

PT-2012-6057

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions 4.5.x prior to 4.5.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a specially crafted name due to an incomplete blacklist...

CVE-2012-5609: Undefined Security Weakness

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file...

PT-2012-6054

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions prior to 4.5.0 Description The issue concerns the "Lost Password" reset functionality, which does not properly check the security token. This allows remote attackers to change an account's...

PT-2012-6055

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters. This affects the apps/user webdavauth/settings.php file...

PT-2012-6053

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions prior to 4.5.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the file name to apps/files versions/js/versions.js or...

XSS vulnerability in user_webdavauth - ownCloud

A cross-site scripting XSS vulnerability in ownCloud 4.5.x before 4.5.2 allow remote attackers to inject arbitrary web script or HTML via the POST data to settings.php in apps/userwebdavauth/ Affected Software ownCloud Server 4.5.2 CVE-2012-5608 Action Taken It is recommended that all instances a...