PT-2014-5539

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue allows remote attackers to hijack user authentication for various requests, including conducting cross-site scripting XSS attacks, modifying files, or renaming files. Recommendation...

PT-2014-5639

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.1 Description The issue allows remote authenticated users to access arbitrary preview pictures due to improper permission checking. Recommendations For ownCloud Server versions prior to 6.0.1, update to...

PT-2014-4455

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 SabreDAV versions prior to 1.7.11 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other...

PT-2014-2305

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.8 Description The issue is related to improper validation of the user id session variable in lib/base.php, allowing remote authenticated users to read arbitrary files via vectors related to WebDAV. Recommendation...

PT-2014-2297

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 4.0.8 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the readyCallback parameter to "apps/files odfviewer/src/webodf/webodf/flashput/PUT.swf", th...

PT-2014-2298

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 4.0.8 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path parameter. Recommendations For versions prior to 4.0.8, update ...

PT-2014-2520

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 4.0.14 ownCloud Server versions 4.5.x prior to 4.5.9 ownCloud Server versions 5.0.x prior to 5.0.4 Description The issue concerns the installation routine of ownCloud Server, where the time function is used to...

PT-2014-4456

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity X...

PT-2014-2435

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.5 Description The issue allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings in the settings/personal.php file. Recommendations For ownCloud versions 4.5.x through...

PT-2014-5535

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.0.0 through 6.0.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is possibly related to the print unescaped function. Recommendations For...

PT-2014-5536

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.16 ownCloud Server versions 6.0.x prior to 6.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print unescaped...

PT-2014-5540

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue affects the document application in ownCloud Server, where sequential values are used for the file id. This allows remote authenticated users to enumerate shared files...

PT-2014-5537

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue allows remote authenticated users to access the contacts of other users via the address book or rename files. Recommendations For ownCloud Server versions prior to 6.0.3, update to...

PT-2014-5541

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.16 ownCloud Server versions 6.0.x prior to 6.0.3 Description The issue allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts, due to improper...

CVE-2014-3832: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the printunescaped function...

CVE-2014-3833: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the 1 Gallery and 2 core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the printunescaped function...

CVE-2014-3834: Undefined Security Weakness

ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to 1 access the contacts of other users via the address book or 2 rename files via unspecified vectors...

CVE-2014-3836: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that 1 conduct cross-site scripting XSS attacks, 2 modify files, or 3 rename files via unspecified vectors...

CVE-2014-3837: Undefined Security Weakness

The document application in ownCloud Server before 6.0.3 uses sequential values for the fileid, which allows remote authenticated users to enumerate shared files via unspecified vectors...

CVE-2012-5057: Undefined Security Weakness

CRLF injection vulnerability in ownCloud Server before 4.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path parameter...