CVE-2012-4397

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...

CVE-2012-4389

CVE-2012-4389 affects ownCloud Server before 4.0.7 due to an incomplete blacklist in lib/migrate.php, enabling remote code execution by uploading a crafted .htaccess inside an import.zip and accessing a PHP file. Impact: arbitrary code execution on affected servers. Mitigation: upgrade to ownClou...

CVE-2012-4753

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-4393

ownCloud before 4.0.6 has multiple CSRF vulnerabilities across 37+ endpoints (e.g., bookmarks, calendar, files, sharing, tasks) that allow remote attackers to hijack user sessions. Red Hat notes that appconfig.php access isn’t properly restricted, enabling edits by remote authenticated users and ...

CVE-2012-4392: Improper Authentication

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

CVE-2012-4389: Undefined Security Weakness

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file...

CVE-2012-4752: Undefined Security Weakness

appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors. NOTE: this can be leveraged by unauthenticated remote attackers using CVE-2012-4393...

CVE-2012-4391: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations...

PT-2012-5575

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.6 Description The issue allows remote authenticated users to edit app configurations due to improper access restrictions in the appconfig.php file. This can potentially be exploited by unauthenticated remote...

PT-2012-5368

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the file parameter in the...

CVE-2012-4390: Exposure of Sensitive Information to an Unauthorized Actor

1 apps/calendar/appinfo/remote.php and 2 apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors...

PT-2012-5370

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different ownCloud components. This includes file names, url, title, tag, page, identity, stack nam...

CVE-2012-4397: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...

CVE-2012-4393: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

CVE-2012-4394: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2012-4396: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 file names to apps/userldap/settings.php; 2 url or 3 title parameter to apps/bookmarks/ajax/editBookmark.php; 4 tag or 5 page parameter to...

PT-2012-5369

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the redirect url parameter in the index.php...

CVE-2012-4753: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

PT-2012-5365

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.7 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations. Recommendations For versions prior to 4.0.7,...

PT-2012-5363

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.7 Description The issue allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file. This is due to an incomplete blacklist...