Updated owncloud package fixes security vulnerabilities

In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted CVE-2015-4715. In ownCloud before 6.0.8 and 8.0.4, the...

ownCloud for iOS Information Disclosure Vulnerability

ownCloud for iOS is a free and open source personal cloud storage solution based on the iOS platform created by German KDE developer Frank Karlitschek. The program offers file management, music storage, calendars, and more. An information disclosure vulnerability exists in ownCloud for iOS. An...

PT-2015-2572

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.0.0 through 6.0.7 ownCloud Server versions 7.0.0 through 7.0.5 ownCloud Server versions 8.0.0 through 8.0.3 Description The issue is related to the filename sanitization component, which does not properly handle $ GE...

PT-2015-2571

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.0.0 through 6.0.7 ownCloud Server versions 7.0.0 through 7.0.5 ownCloud Server versions 8.0.0 through 8.0.3 Description The issue allows remote authenticated users to execute arbitrary SMB commands via a ; semicolon...

PT-2020-7850

Name of the Vulnerable Software and Affected Versions: ownCloud Server versions prior to 6.0.8 ownCloud Server versions 7.x prior to 7.0.6 ownCloud Server versions 8.x prior to 8.0.4 Description: The issue allows remote administrators of Dropbox.com to read arbitrary files. This is possible due t...

ownCloud for iOS Security Bypass Vulnerability

ownCloud for iOS is a free and open source personal cloud storage solution based on the iOS platform created by German KDE developer Frank Karlitschek. The program offers file management, music storage, calendars, and more. A security bypass vulnerability exists in ownCloud for iOS. An attacker c...

Disclosure of users files when deleting parent folders of shared files - ownCloud

Due to a common incorrect usage of the getPath function of the ownCloud virtual filesystem multiple security issues occurred. Especially the function may return null in case the specified file does not exist anymore. When passing the result of getPath in combination with null to functions that...

Server: Disclosure of users files when deleting parent folders of shared files

Due to a common incorrect usage of the getPath function of the ownCloud virtual filesystem multiple security issues occurred. Especially the function may return null in case the specified file does not exist anymore. When passing the result of getPath in combination with null to functions that...

Server: Stored XSS in "activity" application

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

Mobile App: Credentials potentially leaked to other configured ownCloud instance

A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances. Specifically, the ownCloud iOS application allows users to connect to multiple ownCloud instances offering an easy way to swit...

Credentials potentially leaked to other configured ownCloud instance - ownCloud

A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances. Specifically, the ownCloud iOS application allows users to connect to multiple ownCloud instances offering an easy way to swit...

Credentials potentially leaked to other configured ownCloud instance

A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances...

ownCloud Desktop Client Security Bypass Vulnerability

ownCloud is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek. The solution offers file management, music storage, calendars, and more. A security vulnerability exists in ownCloud Desktop Client due to the application failing to properly...

MGASA-2015-0256 Updated owncloud-client package fixes security vulnerability

ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...

Updated owncloud-client package fixes security vulnerability

ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...

PT-2015-6595

Name of the Vulnerable Software and Affected Versions ownCloud Desktop Client versions prior to 1.8.2 Description The issue allows man-in-the-middle attackers to bypass the user's certificate distrust decision and obtain sensitive information by leveraging a self-signed certificate and a connecti...

Stored XSS in "activity" application - ownCloud

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

Command injection when using external SMB storage - ownCloud

The external SMB storage of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. This was caused by improperly sanitizing the ; character which is interpreted as command separator by smbclient the used software to connect to SMB...

Resource Exthaustion when sanitizing filenames - ownCloud

The sanitization component for filenames was vulnerable to DoS when parsing specially crafted file names passed via specific endpoints. Effectively this lead to a endless loop filling the log file until the system is not anymore responsive. Affected Software ownCloud Server 6.0.8 CVE-2015-4717...

Local file inclusion on MS Windows Platform - ownCloud

Due to an improper control of the filename for a requireonce statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions when running on the MS Windows Platform. Depending on the ownCloud configuration and the authentication...