2432 matches found
PT-2016-4844
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 7.0.12 ownCloud Server versions 8.0.x prior to 8.0.10 ownCloud Server versions 8.1.x prior to 8.1.5 ownCloud Server versions 8.2.x prior to 8.2.2 Description A cross-site scripting XSS issue exists, allowing...
CVE-2016-1501: Exposure of Sensitive Information to an Unauthorized Actor
ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages...
ownCloud Arbitrary File Read Vulnerability
OwnCloud is a free and open source personal cloud storage solution from German company OwnCloud. The solution offers file management, music storage, calendars and more. A security vulnerability exists in ownCloud. A remote attacker can exploit the vulnerability to read arbitrary files in the...
PT-2016-4846
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 7.0.12 ownCloud Server versions 8.0.x prior to 8.0.10 ownCloud Server versions 8.1.x prior to 8.1.5 ownCloud Server versions 8.2.x prior to 8.2.2 Description The issue allows remote authenticated users to read...
CVE-2016-1500: Exposure of Sensitive Information to an Unauthorized Actor
ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "fileversions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belongi...
PT-2016-4847
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 8.0.9 ownCloud Server versions 8.1.x prior to 8.1.4 Description The issue allows remote authenticated users to obtain sensitive information via unspecified vectors. This is achieved by revealing the installati...
CVE-2016-1498: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL...
ownCloud 8.2.1 / 8.1.4 / 8.0.9 Information Exposure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-062 Product: ownCloud Manufacturer: ownCloud Inc., Community Affected Versions: ownCloud = 8.2.1, = 8.1.4, = 8.0.9 Tested Versions: 8.1.1, 8.1.4 Vulnerability Type: Information Exposure Through Directory Listing CWE-548 Risk...
Full installation path disclosure through error message - ownCloud
ownCloud returns exception error messages to the user in two different places, allowing an authenticated adversary to gain information about the installation path of the ownCloud instance. There is no further information disclosure. Affected Software ownCloud Server 8.1.4 CVE-2016-1501...
Disclosure of files that begin with ".v" due to unchecked return value - ownCloud
Due to a incorrect usage of the getOwner function of the ownCloud virtual filesystem,done authenticated users with incoming shares of other users are able to access files beginning with ".v" of the sharing user. This can only be exploited if the "filesversions" application is enabled on the serve...
Information Exposure Through Directory Listing in the file scanner - ownCloud
Due to an incorrect usage of an ownCloud internal file system function the passed path to the file scanner was resolved relatively. An authenticated adversary may thus be able to get a listing of files existing on the filesystem. However, it is not possible to access any of these files. This caus...
Reflected XSS in OCS provider discovery - ownCloud
A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Servers allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting. Since ownCloud employs a strict Content-Security-Policy that forbids inline script...
ownCloud: Mixed Active Scripting Issue on stats.owncloud.org
I have come across with a HTTPS security issue - compromises HTTPS security by loading images from non secure source in stats.owncloud.org Vulnerability Type: Mixed Active Scripting Issue Description: Mixed Active Content is content that has access to and can affect all or parts of the Document...
Server: Reflected XSS in OCS provider discovery
A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Servers allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting. Since ownCloud employs a strict Content-Security-Policy that forbids inline script...
Server: Full installation path disclosure through error message
ownCloud returns exception error messages to the user in two different places, allowing an authenticated adversary to gain information about the installation path of the ownCloud instance. There is no further information disclosure. For more information please consult the official advisory. This...
Server: Information Exposure Through Directory Listing in the file scanner
Due to an incorrect usage of an ownCloud internal file system function the passed path to the file scanner was resolved relatively. An authenticated adversary may thus be able to get a listing of files existing on the filesystem. However, it is not possible to access any of these files. This caus...
Server: Disclosure of files that begin with ".v" due to unchecked return value
Due to a incorrect usage of the getOwner function of the ownCloud virtual filesystem,done authenticated users with incoming shares of other users are able to access files beginning with ".v" of the sharing user. This can only be exploited if the "filesversions" application is enabled on the serve...
ownCloud: otrs.owncloud.com: Reflected Cross-Site Scripting
https://otrs.owncloud.com/otrs/index.pl?Action=Login&RequestedURL=&Lang=rue6587"alert160730d78bc6&TimeOffset=-300&User=admin&Password=admin...
ownCloud: Exploiting unauthenticated encryption mode
The owncloud file storage encryption uses the AES encryption algorithm in CFB mode without any authentication. The encryption module is advertised as a way to use a potentially untrusted external storage 1. Let's assume someone uses owncloud with the encryption module and an untrusted storage and...
ownCloud: [https://test1.owncloud.com/owncloud6/] Guessable password used for admin user
On https://test1.owncloud.com/owncloud6/ there is easy to guess password set for admin user. Login with: admin/admin Other instances of owncloud i was able to find on that server have different password set for admin...