ownCloud: [api.owncloud.org] CRLF Injection

PoC: https://api.owncloud.org/%23%0dSet-Cookie:crlf=injection2;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 10:28:01 GMT\r\n Server: Apache\r\n Strict-Transport-Security: max-age=63072000\r\n X-Xss-Protection: 1; mode=block\r\n Location:...

ownCloud: [doc.owncloud.org] CRLF Injection

PoC: http://doc.owncloud.org/%23%0dSet-Cookie:crlf=injection;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 07:58:47 GMT\r\n Server: Apache\r\n Location: https://doc.owncloud.org/\r injection \r Set-Cookie:crlf=injection;domain=.owncloud.org;\r\n...

OwnCloud Android Local Security Bypass Vulnerability

OwnCloud is a free and open source personal cloud storage solution from the German company OwnCloud.OwnCloud for Android is one of the Android versions. A local security bypass vulnerability exists in OwnCloud for Android versions prior to 1.9.1. A local attacker can exploit this vulnerability to...

Read-only share recipient can restore old versions of file - ownCloud

The restore capability of ownCloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions. Affected Software ownCloud Server 9.0.4 CVE-2016-???? core/c93eca49c32428ece03dd67042772d5fa62c8d6e ownCloud Server 8.2.7...

Edit permission check not enforced on WebDAV COPY action - ownCloud

The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files. Affected Software ownCloud Server 9.0.4 CVE-2016-????...

Content-Spoofing in files app - ownCloud

The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user. Affected Software ownCloud Server 9.0.4 CVE-2016-????...

Log pollution can potentially lead to local HTML injection - ownCloud

The "download log" functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the...

Stored XSS in gallery application - ownCloud

Due to a recent migration of the Gallery app to the new sharing endpoint a parameter changed from an integer to a string value. This value wasn't sanitized before and was thus now vulnerable to a Cross-Site-Scripting attack. To exploit this vulnerability an authenticated attacker has to share a...

Server: Read-only share recipient can restore old versions of file

The restore capability of ownCloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Open Redirector involving user interaction - ownCloud

The 'Import root certificate' ability that users are able to use once filesexternal is enabled allows users to import their own root certificates for connections. e.g. server-to-server shares to servers using a self-signed certificate or external storages The functionality was using the PHP OpenS...

ownCloud: ownCloud 2.2.2.6192 DLL Hijacking Vulnerability

Summary ownCloud contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to some DLL file is loaded by 'ownCloud-2.2.2.6192-setup.exe' improperly. And it allows an attacker to load...

Fedora 24 : owncloud (2016-cfa7b58c7e)

Owncloud now follows the PHP SIG direction of using a fedora autoloader to directly call the autoloaders of the PHP libraries used. In addition a %check has been added to ensure the autoloader works correctly and new dependency versions bumped to match more closely with upstream. This also update...

Fedora 23 : owncloud (2016-6f479decc6)

Owncloud now follows the PHP SIG direction of using a fedora autoloader to directly call the autoloaders of the PHP libraries used. In addition a %check has been added to ensure the autoloader works correctly and new dependency versions bumped to match more closely with upstream. This also update...

Fedora 22 : owncloud (2016-377b1a015c)

Owncloud now follows the PHP SIG direction of using a fedora autoloader to directly call the autoloaders of the PHP libraries used. In addition a %check has been added to ensure the autoloader works correctly and new dependency versions bumped to match more closely with upstream. This also update...

Insecure Direct Object References in Gallery - ownCloud

ownCloud was vulnerable to a insecure direct object reference. Any unauthenticated user would be able to download any image from the server if the gallery app is enabled. Affected Software ownCloud Server 8.2.6 CVE-2016-5876 gallery/2e8f1f2509d15876ab09396dfe6c463aacdf5c5b ownCloud Server 9.0.3...

Incorrect setup of external storage - ownCloud

The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups. The storage class is setup without any setup information, leading t...

Disclosure of arbitrary certificate files - ownCloud

The 'Import root certificate' ability that users are able to use once filesexternal is enabled allows users to import their own root certificates for connections. e.g. server-to-server shares to servers using a self-signed certificate or external storages The functionality was using the PHP OpenS...

Server: Incorrect setup of external storage

The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups. The storage class is setup without any setup information, leading t...

Server: Insecure Direct Object References in Gallery

ownCloud was vulnerable to a insecure direct object reference. Any unauthenticated user would be able to download any image from the server if the gallery app is enabled. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

ownCloud/Nextcloud Unprotected Data Directory (HTTP)

ownCloud/Nextcloud is exposing an unprotected data directory. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...