CVE-2014-4929

CVE-2014-4929 affects ownCloud Server via a Local File Inclusion in the routing component caused by improper control of the filename for a require_once() in the routing code. Affected versions are ownCloud Server < 5.0.17 and

PT-2014-6213

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.17 ownCloud Server versions 6.0.x prior to 6.0.4 Description A directory traversal issue exists in the routing component, allowing remote attackers to include and execute arbitrary local files by using a...

CVE-2014-4929: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in a filename, related to index.php...

Insufficient RSA Host Key validation in files_external (SFTP driver) - ownCloud

The SFTP external storage driver was verifying the RSA Host Key after logging in. This allows for a man-in-the-middle MITM attack even if the host key is already known and can be validated. Basically, at the point where the host key was validated, the secret has already been given away. It should...

Mandriva Linux Security Advisory : owncloud (MDVSA-2014:140)

Updated owncloud package fixes security vulnerability : In ownCloud before 5.0.17 and 6.0.4, there exists a limited local file inclusion vulnerability due to an improper control of the filename for a requireonce statement in the routing component CVE-2014-4929. See the upstream Changelog for more...

MGASA-2014-0301 Updated owncloud packages fix an unspecified security vulnerability

Updated owncloud package fixes security vulnerability: Owncloud versions 5.0.17 and 6.0.4 fix an unspecified security vulnerability, as well as many other bugs. See the upstream Changelog for more information...

Updated owncloud packages fix an unspecified security vulnerability

Updated owncloud package fixes security vulnerability: Owncloud versions 5.0.17 and 6.0.4 fix an unspecified security vulnerability, as well as many other bugs. See the upstream Changelog for more information...

PT-2014-9135

Name of the Vulnerable Software and Affected Versions owncloud versions prior to 5.0.17 owncloud versions prior to 6.0.4 Description The issue is related to an unspecified security vulnerability. For more information, refer to the upstream Changelog. Recommendations For owncloud versions prior to...

Server: Local file inclusion in core

Due to an improper control of the filename for a requireonce statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions. Depending on the ownCloud configuration and the authentication state of a remote attacker this...

Local file inclusion in core - ownCloud

Due to an improper control of the filename for a requireonce statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions. Depending on the ownCloud configuration and the authentication state of a remote attacker this...

Fedora Update for owncloud FEDORA-2014-7964

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 20 Update: owncloud-6.0.4-1.fc20

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

Fedora 20 : owncloud-6.0.4-1.fc20 (2014-7964)

update to 6.0.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

Users can mount the local filesystem - ownCloud

Due to an insufficient permission check authenticated users are able to access preview pictures of others users. Affected Software ownCloud Server 6.0.1 Action Taken It is recommended that all instances are upgraded to ownCloud Server 6.0.2. Acknowledgements The ownCloud team thanks the following...

Users can mount the local filesystem - ownCloud

Due to not properly sanitzing the mount configuration authenticated users are able to mount the local filesystem into their ownCloud. A successful exploit requires the filesexternal app to be enabled. Affected Software ownCloud Server 6.0.2 ownCloud Server 5.0.15 Action Taken It is recommended th...

Multiple XSS - ownCloud

Multiple stored and reflected XSS have been adressed. Affected Software ownCloud Server 6.0.2 Action Taken Acknowledgements The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory: Dirk van Veen - Itq [email protected] - Vulnerability...

XXE in multiple third party components - ownCloud

Multiple third party components of ownCloud are vulnerable to XXE attacks, which may lead to: Local File Disclosure Server Side Request Forgery DoS Code Execution depending on the PHP wrappers … The following libraries are affected: ZendFramework: CVE-2014-2052 GetID3: CVE-2014-2053 PHPExcel:...

LDAP injection - ownCloud

Due to not properly sanitizing the LDAP queries an attacker is able to: Gain information about existing LDAP users Modify the login query, e.g. with a wildcard Affected Software ownCloud Server 6.0.2 CVE-2014-2047 ownCloud Server 5.0.15 CVE-2014-2049 Action Taken All LDAP queries have been review...

Host Header Poisoning - ownCloud

Due to trusting user supplied input and interpret it as Host header an attacker is able to craft a password reset mail with a link pointing to his own site. If a user clicks on the link or a software e.g. antivirus is accessing the link the attacker is able to reset the user password. Affected...

Insecure Flash Cross Domain policies - ownCloud

Due to insecure Flash Cross Domain policies an attacker might gain access to stored files of the user. Affected Software ownCloud Server 6.0.2 CVE-2014-2047 ownCloud Server 5.0.15 CVE-2014-2049 Action Taken All packaged Flash files have been audited whether they have potentially insecure Cross...