CVE-2014-9048

The CVE-2014-9048 entry concerns ownCloud Server’s documents application, where the vulnerability arises from missing access control in the API. Affected versions are ownCloud Server < 6.0.6 (i.e., 6.x prior to 6.0.6) and

CVE-2014-5341

The CVE-2014-5341 issue affects the ownCloud Server SFTP external storage driver (files_external) prior to version 6.0.5. The root cause is improper RSA host key validation after login, enabling potential information disclosure via network sniffing (MITM-like exposure). Exploitation details are s...

CVE-2014-9045

Summary: CVE-2014-9045 affects the ownCloud Server FTP backend in the external user_External backend. The flaw arises because the FTP backend did not URL-encode credentials, allowing a remote attacker to bypass authentication with a crafted password. Affected versions (per sources): ownCloud Serv...

CVE-2014-9046

The OCUtil::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol...

CVE-2014-9047

CVE-2014-9047 affects ownCloud 6.x before 6.0.6 and 7.x before 7.0.3. The vulnerability is a local file disclosure via the preview system, enabling reading arbitrary files through unknown vectors. Multiple connected sources (NVD entry and ownCloud security advisory) confirm the affected versions ...

PT-2015-4139

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.18 ownCloud Server versions 6.x prior to 6.0.6 Description The issue allows remote attackers to bypass intended authentication requirements. This is achieved by crafting a password that exploits the FTP...

PT-2015-4140

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.18 ownCloud Server versions 6.x prior to 6.0.6 ownCloud Server versions 7.x prior to 7.0.3 Description The issue allows remote attackers to read arbitrary files. This is due to the OC Util::getUrlContent...

CVE-2014-9046: Exposure of Sensitive Information to an Unauthorized Actor

The OCUtil::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol...

CVE-2014-5341: Exposure of Sensitive Information to an Unauthorized Actor

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

PT-2015-4135

Name of the Vulnerable Software and Affected Versions ownCloud server versions prior to 5.0.18 ownCloud server versions 6.x prior to 6.0.6 ownCloud server versions 7.x prior to 7.0.3 Description The issue concerns the import functionality in the bookmarks application, which fails to validate CSRF...

PT-2015-4136

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.18 ownCloud versions 6.x prior to 6.0.6 ownCloud versions 7.x prior to 7.0.3 Description The issue is related to a cross-site scripting XSS vulnerability in the import functionality of the bookmarks application...

PT-2015-3794

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.5 Description The issue concerns the SFTP external storage driver in ownCloud Server, where the RSA Host key is validated after login. This allows remote attackers to obtain sensitive information by sniffi...

PT-2015-4138

Name of the Vulnerable Software and Affected Versions ownCloud versions 7.0.0 through 7.0.2 Description The issue allows remote attackers to obtain sensitive information via a brute force attack, due to the use of an MD5 hash of the absolute file paths of the original CSS and JS files as the name...

PT-2015-4137

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.18 ownCloud versions 6.x prior to 6.0.6 ownCloud versions 7.x prior to 7.0.3 Description The issue allows remote attackers to bypass authentication by using a null byte in the password and a valid user name,...

PT-2015-4143

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.x through 6.0.5 ownCloud Server versions 7.x through 7.0.2 Description The issue in the documents application allows remote authenticated users to obtain all valid session IDs via an unspecified API method...

PT-2015-4142

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.x through 6.0.5 ownCloud Server versions 7.x through 7.0.2 Description The issue allows remote attackers to bypass the password-protection for shared files via the API. Recommendations For ownCloud Server versions 6....

PT-2015-4141

Name of the Vulnerable Software and Affected Versions ownCloud versions 6.x through 6.0.5 ownCloud versions 7.x through 7.0.2 Description The issue allows remote attackers to read arbitrary files via unknown vectors. Recommendations For ownCloud versions 6.x through 6.0.5, update to version 6.0.6...

CVE-2014-9049: Exposure of Sensitive Information to an Unauthorized Actor

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method...

CVE-2014-9043: Improper Authentication

The userldap aka LDAP user and group backend application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind...

CVE-2014-9041: Cross-Site Request Forgery (CSRF)

The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks...