CVE-2013-1939

The CVE-2013-1939 issue affects SabreDAV’s HTML/Browser plugin used in ownCloud on Windows, where improper checking of path separators in the base path allows remote attackers to read arbitrary files via a backslash character. Concrete details in connected documents show that SabreDAV versions 1....

CVE-2013-2085

CVE-2013-2085: ownCloud Server directory traversal via apps/files_trashbin/index.php (dir parameter). Affected: ownCloud Server prior to 5.0.6; vulnerability allows remote authenticated users to access arbitrary local files. Root cause: improper handling of .. in dir parameter enabling directory ...

CVE-2013-2043

CVE-2013-2043 affects ownCloud calendar handling: the script apps/calendar/ajax/events.php fails to properly verify calendar ownership, enabling remote authenticated users to download arbitrary calendars via the calendar_id parameter. Affected versions are ownCloud before 4.5.11 and 5.x before 5....

CVE-2013-2042

CVE-2013-2042 affects ownCloud, with XSS vulnerabilities in the bookmarks functionality. The description specifies that remote authenticated users could inject arbitrary web script or HTML via the url parameter to two endpoints: apps/bookmarks/ajax/addBookmark.php and apps/bookmarks/ajax/editBook...

CVE-2013-1939

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ backslash character...

CVE-2013-2150

Multiple cross-site scripting XSS vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files...

CVE-2013-2044

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2013-2086

The CVE-2013-2086 issue affects ownCloud 5.0.x prior to 5.0.6, where the configuration loader writes CSRF tokens (and other private data) into an accessible JavaScript file. This leakage enables remote attackers to obtain CSRF tokens and other sensitive information, per the official advisory and ...

CVE-2013-2040

CVE-2013-2040 corresponds to multiple XSS vulnerabilities in ownCloud. Affected are ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6, where remote authenticated users can inject arbitrary web script or HTML via unspecified vectors. Connected sources corroborate the vulnerabilit...

CVE-2013-2040

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1851

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the usermigrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors...

CVE-2013-1963

The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors...

CVE-2014-2049

The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors...

CVE-2014-2047

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-2048

The CVE-2013-2048 issue affects ownCloud Server prior to 5.0.6, where an insufficient permission check allows authenticated users to execute arbitrary API commands via unspecified vectors, with CSRF enabling remote command execution. The root cause is an inadequate access-control check on API com...

CVE-2013-2149

CVE-2013-2149: ownCloud is vulnerable to cross-site scripting via shared files. Mageia MGASA-2013-0171 notes XSS in js/viewer.js and core/js/oc-dialogs.js, exploitable in all ownCloud versions before 5.0.7 and 4.0.16. Affected components include files_videoviewer; impact is arbitrary script injec...

CVE-2013-2043

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendarid parameter...

CVE-2013-1850

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

CVE-2013-2086

The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file...

CVE-2013-1822

ownCloud 4.5.x before 4.5.8 is affected by multiple XSS vulnerabilities (CVE-2013-1822). The flaws allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via (1) quota parameter to /core/settings/ajax/setquota.php, (2) group field to settings.php, or...