ownCloud: SMB User Authentication Bypass and Persistence

Authentication Bypass ================== The external user authentication app in OwnCloud does not properly authenticate against an SMB server. In it's current implementation, the file owncloud/apps/userexternal/lib/smb.php, line 46-47 uses the command smbclient -L //host/dummy -Uuser%pass, where...

Fedora Update for owncloud FEDORA-2016-6f479decc6

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for owncloud FEDORA-2016-cfa7b58c7e

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for owncloud FEDORA-2016-377b1a015c

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 23 Update: owncloud-8.2.4-1.fc23

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

[SECURITY] Fedora 22 Update: owncloud-8.2.4-1.fc22

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

[SECURITY] Fedora 24 Update: owncloud-8.2.4-1.fc24

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

Updated owncloud packages fix security vulnerabilities

Updated owncloud package fixes security vulnerabilities: The owncloud package has been updated to version 8.0.12, which fixes undisclosed security issues and other bugs...

MGASA-2016-0167 Updated owncloud packages fix security vulnerabilities

Updated owncloud package fixes security vulnerabilities: The owncloud package has been updated to version 8.0.12, which fixes undisclosed security issues and other bugs...

PT-2016-7961

Name of the Vulnerable Software and Affected Versions owncloud versions prior to 8.0.12 Description The issue concerns undisclosed security problems and other bugs in owncloud. Recommendations For versions prior to 8.0.12, update to version 8.0.12 to resolve the issue...

ownCloud: doc.owncloud.com: PHP info page disclosure

URL :- http://doc.owncloud.com/t/ Description :- phpinfo is a debug functionality that prints out detailed information on both the system and the PHP configuration. An attacker can obtain information such as: •Exact PHP version. •Exact OS and its version. •Details of the PHP configuration...

ownCloud: Open Redirector via (apps/files_pdfviewer) for un-authenticated users.

Affected Products: OWNCLOUD https://demo.owncloud.org/index.php/apps/filespdfviewer Version Tested: v1.0.712, other versions might be vulnerable Class: Open Redirector Remote: Yes A non authenticated user can be easily tricked into following one of the following links in order to download a...

ownCloud: doc.owncloud.org: XSS via Referrer

Hi, The Referer Header in the following request, can be used to trigger an XSS. GET /promote/ HTTP/1.1 Host: doc.owncloud.org User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:45.0 Gecko/20100101 Firefox/45.0 Referer: javascript:alert'XSS'; Accept:...

ownCloud: Cross site scripting in apps.owncloud.com

Vulenrablity Affects : http://apps.owncloud.com/lib/freecaptcha/freecapwrap.php POC : URI was set to : "alert1 url : http://apps.owncloud.com/lib/freecaptcha/freecapwrap.php/"prompt1 Screenshot : enclosed...

Bypass of application specific PIN - ownCloud

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...

Mobile App: Bypass of application specific PIN

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...

Bypass of application specific PIN

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...

ownCloud: doc.owncloud.org: X-XSS-Protection not enabled

X-Xss-Protection @https://doc.owncloud.org/ has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and 1;...

ocloud for owncloud - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application ocloud for owncloud published at the 'play' market has multiple vulnerabilities...

ownCloud: Reflected XSS in owncloud.com

xss does work only for inetrnet explorer, for all versions how to reproduce? : 1. to use internet explorer browseri have test with ie11 2. go to page https://owncloud.com/wp-123.php?action=document.location.href=location.hash.slice1javascript:alertdocument.domain 3. will be alert box with name of...