CVE-2015-4717

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

CVE-2015-4718

The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; semicolon character in a file...

CVE-2015-4717

CVE-2015-4717 affects ownCloud Server: the filename sanitization component fails to properly handle $_GET parameters cast to an array, allowing remote attackers to trigger a denial of service (infinite loop and log file consumption) via crafted endpoint file names. Affected versions are before 6....

CVE-2015-4717

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

CVE-2015-4718

CVE-2015-4718 affects ownCloud Server’s external SMB storage driver. Affected versions are ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4. The vulnerability allows remote authenticated users to execute arbitrary SMB commands via a semicolon character in a file, enabling ...

CVE-2015-5954

The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a fil...

CVE-2015-5954

The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a fil...

CVE-2015-4716

Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors...

CVE-2015-4716

CVE-2015-4716 is a directory traversal vulnerability in ownCloud Server’s routing component affecting Windows deployments; affected versions are before 7.0.6 and 8.0.x before 8.0.4, allowing remote attackers to reinstall the application or execute arbitrary code via unspecified vectors. Debian ad...

CVE-2015-5954

The CVE-2015-5954 issue affects ownCloud Server: vulnerable versions include 6.0.x before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5. The root cause is that the virtual filesystem does not treat NULL as a valid getPath return value in a sharing context, allowing remote authenticated users ...

CVE-2015-4718

The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; semicolon character in a file...

CVE-2015-5953

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

Cross site scripting

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-5953

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-5953

The CVE-2015-5953 issue is an XSS vulnerability in the ownCloud Server activity module, exploitable by an authenticated remote user via a double-quote character in a filename in a shared folder. Affected are ownCloud Server versions prior to 7.0.5 and 8.0.x prior to 8.0.4. The problem is describe...

CVE-2015-5953

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-5953

Cross-site scripting XSS vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " double quote character in a filename in a shared folder...

CVE-2015-4717: Undefined Security Weakness

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

CVE-2015-4716: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors...

CVE-2015-4718: Improper Neutralization of Special Elements used in an OS Command

The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; semicolon character in a file...