ownCloud XSS and CSRF Protection Bypass Vulnerabilities (Mar 2018) - Windows

ownCloud is prone to XSS and CSRF vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

Cross site scripting

Cross-site scripting XSS vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file...

CVE-2014-1665

Cross-site scripting XSS vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file...

CVE-2014-1665

Cross-site scripting XSS vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file...

UBUNTU-CVE-2014-1665

Cross-site scripting XSS vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file...

CVE-2014-1665

Cross-site scripting XSS vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file...

CVE-2014-1665

CVE-2014-1665 is an XSS vulnerability in ownCloud prior to 6.0.1 where an authenticated user could inject script via the filename of an uploaded file. Affected products include ownCloud versions 6.x up to 6.0.1 (with multiple sources citing 6.0.0a and 6.0.0-era builds). Root cause is mishandling ...

OwnCloud Server 10.0 User Enumeration

Class User Enumeration CVE Remote Yes Credit n4xh4ck5 Home https://github.com/n4xh4ck5 Vulnerable Owncloud Server 8.1 to 10.0 Once time authenticated in the application, the Owncloud funcionality let to User enumeration due the different error messages of the server. The vulnerabiblity it finds i...

ownCloud: OS Command Injection via tainted PATH environment variable in findBinaryPath

The PATH environment variable is passed to the find command in owncloud/core/blob/master/lib/private/legacy/helper.php on line 543 is not sanitized for input. If an adversary is able to taint the PATH environment variable, OS command execution is possible utilizing the find command's execute -exe...

ownCloud: Password Complexity Not Enforced On Password Change

Hi! Owncloud does not enforce password complexity on password change, so it's possible to use passwords of any size or form. In example I can set my password to be "a" or "qwerty". How to reproduce: Change your password to something that does not match your required complexity. Proof Of Concept:...

ownCloud: owncloud.com open redirect

Open redirect on owncloud.com...

ownCloud: This is not the security issue.

Here a subdomain path: https://apps.owncloud.com/ a strange thing in this domain is that a new user can not create account but he can login in. On that path:- https://apps.owncloud.com/usermanager/new.php In this path registration file has been removed or something and saying 404 error. I mean wh...

ownCloud Multiple XSS Vulnerabilities

ownCloud is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ownCloud Multiple Vulnerabilities (May 2017)

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if description...

Code injection

An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2...

CVE-2017-8896

ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters...

CVE-2017-9340

An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2...

CVE-2017-9339

A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

CVE-2017-9338

Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...

CVE-2017-9339

A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...