1964 matches found
PT-2024-15265 · Kiteworks · Kiteworks Owncloud
Name of the Vulnerable Software and Affected Versions: Kiteworks OwnCloud affected versions not specified Description: Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty strin...
ownCloud 安全漏洞
ownCloud is a suite of personal cloud storage solutions from the US-based company ownCloud. A security vulnerability exists in version 10.12 and earlier versions of ownCloud that stems from the presence of cross-site request forgery, allowing an unauthenticated attacker to forge requests...
ownCloud < 10.15.0 Multiple Vulnerabilities
ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...
Cross-site Request Forgery in diagnostics app - ownCloud
Improper handling of CSRF protection in the diagnostics app in combination with the SameSite-Cookie setting being set to None allows cross site invocation of an admin API...
ownCloud Phpinfo Reader
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ownCloud Phpinfo Reader', 'Description' = %q Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Owncloud Graph_Api
🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the...
ownCloud < 10.14.0 Multiple Improper Input Validation Vulnerabilities
ownCloud is prone to multiple improper input validation vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
ownCloud < 10.13.3 Improper Input Validation Vulnerability
ownCloud is prone to an improper input validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Authentication Bypass Using Pre-signed URLs - ownCloud
Improper validation may allow an attacker to bypass authentication and gain access to users’ files. Prior knowledge of a username and a file path is needed in order to gain access to a certain file...
Biometric Authentication Bypass - ownCloud
Improper validation in the Biometric authentication process may allow an attacker to bypass that process and gain unauthorized access. This attack requires physical access to the vulnerable device...
Improper Validation in the User Profile Metadata - ownCloud
Improper Validation in the User Profile Metadata may allow an authenticated attacker to edit their own profile in a way that consumes a substantial amount of resources, creating a Denial of Service...
Improper Validation in the User's Avatar Mechanism - ownCloud
Improper Validation in the User’s Avatar Mechanism may allow an authenticated attacker to edit their own profile in a way that consumes a substantial amount of resources, creating a Denial of Service...
Denial of Service in Comments API - ownCloud
Insufficient input validation in the Comments Plugin may allow an authenticated attacker to cause a Denial of Service...
ownCloud: Authentication Bypass with usage of PreSignedURL
The ownCloud Infinite Scale oCIS was identified to be vulnerable to an authentication bypass vulnerability due to an issue with the default-enabled PreSignedURL feature. The vulnerability allowed access to any file without authentication, given the prior knowledge of the username and filename. Th...
ownCloud Server < 10.13.3 Multiple Vulnerabilities
The version of ownCloud installed on the remote host is prior to 10.13.3. It is, therefore, affected by multiple vulnerabilities: - An issue was discovered in ownCloud owncloud/graphapi The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed,...
OwnCloud OwnCloud Web Interface Detection
Binary data owncloudowncloudwebdetect.nbin...
OwnCloud OwnCloud Installed (Linux)
Binary data owncloudowncloudnixinstalled.nbin...
Metasploit Wrap-Up 12/8/2023
Are You Looking for ACTION? Our very own adfoster-r7 has added a new feature that adds module actions, targets, and aliases to the search feature in Metasploit Framework. As we continue to add modules with diverse goals or targets, we’ve found ourselves leaning on these flags more and more...
ownCloud Phpinfo Reader Exploit
Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app graph installed contain a test file which prints phpinfo to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter. Docker m...
OwnCloud 10.6.x < 10.13.1 WebDav Authentication Bypass
An Authentication Bypass was discovered in OwnCloud 10.6.x prior to 10.13.1 in the WebDAV protocol. An unauthenticated attacker can access, modify or delete any file if a victim's username is known and the victim has no signing key configured because pre-signed URLs can be accepted even if no...