HackerOne: External links should use rel="noopener" or use the redirect service

This is a rather low severity one and a successful exploitation relies on unlikely user interaction as well as the ability to control the HTML output of an remote host. Furthermore it is a kinda new hardening features in some browsers. Though one can work around this using "noreferrer" which is...

ownCloud: doc.owncloud.org has missing PHP handler

When visiting the following URL https://doc.owncloud.org/server/8.2/go.php?to=admin-backup the web server does interpret the php code but delivers the php code itself. This might expose internal information to anyone visiting the website...

Fedora 21 : owncloud-8.0.9-1.fc21 (2015-a117082cd2)

This update provides the latest upstream release of ownCloud in the current minor series - 8.0.9 for all releases but EPEL 6, 7.0.11 for EPEL 6. These releases come with unspecified 'security improvements', so updating quickly is recommended. As usual, a minor update should apply smoothly, but we...

Fedora 23 : owncloud-8.0.9-1.fc23 (2015-a6be3a6810)

This update provides the latest upstream release of ownCloud in the current minor series - 8.0.9 for all releases but EPEL 6, 7.0.11 for EPEL 6. These releases come with unspecified 'security improvements', so updating quickly is recommended. As usual, a minor update should apply smoothly, but we...

Fedora 23 : owncloud-8.0.10-1.fc23 (2016-a576196426)

This update provides the new upstream patch release of ownCloud 7.0.12 for EPEL 6, 8.0.10 for all other distributions. It also adds a 'well-known' redirect for WebDAV alongside the existing ones for CalDAV and CardDAV - if you don't know what this is, don't worry. These are bugfix updates which...

Fedora 22 : owncloud-8.0.9-1.fc22 (2015-85760004ca)

This update provides the latest upstream release of ownCloud in the current minor series - 8.0.9 for all releases but EPEL 6, 7.0.11 for EPEL 6. These releases come with unspecified 'security improvements', so updating quickly is recommended. As usual, a minor update should apply smoothly, but we...

ownCloud Multiple Vulnerabilities (Mar 2016) - Linux

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

ownCloud Multiple Vulnerabilities (Mar 2016) - Windows

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

ownCloud Information Exposure Vulnerability (Feb 2016) - Linux

ownCloud is prone to an information exposure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud 8.0.x < 8.0.9, 8.1.x < 8.1.4 Path Disclosure Vulnerability - Linux

ownCloud is prone to path disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud Information Exposure Vulnerability (Feb 2016) - Windows

ownCloud is prone to an information exposure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud 8.0.x < 8.0.9, 8.1.x < 8.1.4 Path Disclosure Vulnerability - Windows

ownCloud is prone to path disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud: DROWN Attack

Hi, I want to report a drown attack in .owncloud.com. A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable serve...

Protecting Personal Information: Freedom Box

FreedomBox is a personal server that protects your privacy. It hosts on demand applications such as file sharing, shared calendaring, instant messaging, secure voice conference calling, blog and wiki. FreedomBox is a free software stack, a subset of the Debian universal operating system, that can...

ownCloud: owncloud.com: Persistent XSS In Account Profile

Quotation marks are not sanitized in one of the HTML tags inside of the profile when dealing with first & last names. It is an tag. In the attached PoC screenshot, I included a functional first name that triggers an alert call. Inside, I pasted the HTML tag where it breaks. I don't know owncloud...

Mageia: Security Advisory (MGASA-2016-0040)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : owncloud -- multiple vulnerabilities (3166222b-c6a4-11e5-96d6-14dae9d210b8)

Owncloud reports : - Reflected XSS in OCS provider discovery oC-SA-2016-001 - Information Exposure Through Directory Listing in the file scanner oC-SA-2016-002 - Disclosure of files that begin with '.v' due to unchecked return value oC-SA-2016-003 %NASLMINLEVEL 70300 C Tenable Network Security,...

MGASA-2016-0040 Updated owncloud packages fix security vulnerability

A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Server before 8.0.10 allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting CVE-2016-1498. ownCloud Server before 8.0.10 allows remote authenticated...

Updated owncloud packages fix security vulnerability

A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Server before 8.0.10 allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting CVE-2016-1498. ownCloud Server before 8.0.10 allows remote authenticated...

ownCloud: No Any Kind of Protection on Delete account

@gamho69 reported an issue within the owncloud.com website that allowed an attacker to send a delete request for owncloud.com account for other users if the mail address was known. This issue did not affect ownCloud server and only the marketing related activity on owncloud.com. Furthermore the...