Possibility to extend internal share permissions using the API – ownCloud

An Attacker can extend the permission of a received internal-share using the ocs-api. Check is currently only done in the UI. Affected Software ownCloud Server 10.2.1 CVE-2019-???? core/4ae39f7c70bb26e55d7396184da5c30dd75980a3 Action Taken Added better checks which prevent extending the permissio...

Possibility to extend internal share permissions using the API - ownCloud security advisory

Platform: ownCloud Server Versions: 10.0.0 Date: 7/25/2019 Risk level: High CVSS v3 Base Score: 8 Improper Privilege Management, CWE-269...

ownCloud: Remote Code Execution through Deserialization Attack in OwnBackup app.

I found a deserialization vulnerability in the OwnBackup app, this vulnerability allows to execute remote code in the server. An administrator user could install the vulnerable app, or take advantage of this vulnerability if the OwnBackup application is installed. Below are the steps to properly...

oc.owncloud.com XSS vulnerability

Open Bug Bounty ID: OBB-696020 Description| Value ---|--- Affected Website:| oc.owncloud.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ownCloud 0.1.2 User Impersonation Authorization Bypass Vulnerability

Exploit for php platform in category web applications Product: ownCloud Impersonate Vendor: ownCloud CSNC ID: CSNC-2018-015 CVE ID: N/A Subject: Authorization bypass Risk: High Effect: Remotely exploitable Author: Thierry Viaccoz Date: 29.08.2018 Introduction: ------------- ownCloud 1 is a suite ...

ownCloud 0.1.2 User Impersonation Authorization Bypass

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: ownCloud Impersonate Vendor: ownCloud CSNC ID: CSNC-2018-015 CVE ID: N/A Subject: Authorization bypass Risk: High Effect: Remotely exploitable Author: Thierry Viaccoz Date: 29.08.2018 Introduction:...

ownCloud iOS Application 3.7.3 Cross Site Scripting Vulnerability

Exploit for iOS platform in category web applications COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: ownCloud iOS Application owncloud.iosapp 1 Vendor: ownCloud Gmbh CSNC ID: CSNC-2018-016 CVE ID: N/A Subject: Cross-Site Scripting in ownCloud iOS...

ownCloud iOS Application 3.7.3 Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: ownCloud iOS Application owncloud.iosapp 1 Vendor: ownCloud Gmbh CSNC ID: CSNC-2018-016 CVE ID: N/A Subject: Cross-Site Scripting in ownCloud iOS Application's WebViews Risk: Low Effect: Remotely exploitable...

ownCloud: Possible to steal any protected files on Android

Hi. I have found an issue which allows to retrieve any files from /data/data/com.owncloud.android/ directory. The problem is in exported activity com.owncloud.android.ui.activity.ReceiveExternalFilesActivity which accepts a URI to download files. I see that you've added verification path...

PHPUnit 'CVE-2017-9841' RCE Vulnerability (HTTP) - Active Check

PHPUnit is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only nb: - For very large web pages w...

ownCloud Cross-Site Scripting Vulnerability (CNVD-2018-08527)

ownCloud is a free and open source personal cloud storage solution from German company ownCloud. The solution offers file management, music storage, calendars, and more. A cross-site scripting vulnerability exists in versions prior to ownCloud 6.0.1. A remote attacker can exploit this vulnerabili...

ownCloud 'OpenID' Access Control Bypass Vulnerability - Linux

ownCloud is prone to an access control bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud 'OpenID' Access Control Bypass Vulnerability - Windows

ownCloud is prone to an access control bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud Server user_openid Security Bypass Vulnerability

ownCloud is a free and open source personal cloud storage solution from the German company ownCloud, which provides file management, music storage, calendaring, etc. ownCloud Server is a server version. useropenid app is one of the user ID acquisition apps. A security vulnerability exists in the...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

Information disclosure

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

CVE-2014-2048

CVE-2014-2048 corresponds to an access-control bypass in ownCloud Server via the user_openid app caused by an insecure OpenID implementation. Technical details in connected sources show the issue affects ownCloud Server versions prior to 5.0.15, with the vulnerability enabling remote login by an ...