2432 matches found
PT-2014-2520
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 4.0.14 ownCloud Server versions 4.5.x prior to 4.5.9 ownCloud Server versions 5.0.x prior to 5.0.4 Description The issue concerns the installation routine of ownCloud Server, where the time function is used to...
PT-2014-4456
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity X...
PT-2014-2435
Name of the Vulnerable Software and Affected Versions ownCloud versions 4.5.x through 4.5.5 Description The issue allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings in the settings/personal.php file. Recommendations For ownCloud versions 4.5.x through...
PT-2014-5535
Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.0.0 through 6.0.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is possibly related to the print unescaped function. Recommendations For...
PT-2014-5536
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.16 ownCloud Server versions 6.0.x prior to 6.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print unescaped...
PT-2014-5541
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.16 ownCloud Server versions 6.0.x prior to 6.0.3 Description The issue allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts, due to improper...
PT-2014-5538
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.16 ownCloud Server versions 6.0.x prior to 6.0.3 Description The issue is related to insufficient permission checks for the files external application, allowing remote authenticated users to add external...
PT-2014-5639
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.1 Description The issue allows remote authenticated users to access arbitrary preview pictures due to improper permission checking. Recommendations For ownCloud Server versions prior to 6.0.1, update to...
PT-2014-4454
Name of the Vulnerable Software and Affected Versions PHPExcel versions prior to 1.8.0 ownCloud Server versions prior to 5.0.15 ownCloud Server versions 6.0.x prior to 6.0.2 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other...
PT-2014-5540
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue affects the document application in ownCloud Server, where sequential values are used for the file id. This allows remote authenticated users to enumerate shared files...
PT-2014-2305
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.8 Description The issue is related to improper validation of the user id session variable in lib/base.php, allowing remote authenticated users to read arbitrary files via vectors related to WebDAV. Recommendation...
CVE-2012-5056: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 readyCallback parameter to apps/filesodfviewer/src/webodf/webodf/flashput/PUT.swf, the 2 root parameter to apps/gallery/templates/index.php, or...
PT-2014-5537
Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue allows remote authenticated users to access the contacts of other users via the address book or rename files. Recommendations For ownCloud Server versions prior to 6.0.3, update to...
Deserialization of Untrusted Data in core - ownCloud
Due to the deserialization of unstrusted data in core an attacker might be able to delete arbitrary files from the filesystem or executing arbitrary SQL queries. This issue has been found in a widely used third-party library, we have removed the component due to general quality concerns from the...
Improper authorization checks in core - ownCloud
Due to an improper authorization check in core an attacker with access to at least two user account is able to access the file names of other users. Our post-mortem audit showed that this vulnerability does not leak any content of the file or the directory structure except the filename. Affected...
Enumeration of shared files in documents - ownCloud
Due to using the auto-incrementing fileid instead of the random generated token to access files in the documents app an authenticated users could enumerate shared files of other users. Affected Software ownCloud Server 6.0.3 CVE-2014-3837 Action Taken We replaced the usage of fileid with our rand...
CSRF in documents - ownCloud
Due to not verifying whether a request was intentionally provided by the user who submitted an request the documents application is vulnerable against several CSRF attacks. An attacker could have used this to arbitrary modify existing files or rename it. Affected Software ownCloud Server 6.0.3...
Improper authorization checks in files_external - ownCloud
Due to not verifying whether an user has been granted access to add external storages an authenticated user could even mount external storage e.g. SMB/FTP/etc. without permission. Affected Software ownCloud Server 6.0.3 CVE-2014-3835 ownCloud Server 5.0.16 CVE-2014-3835 Action Taken We reviewed t...
Improper authorization checks in contacts - ownCloud
Due to not verifying whether an user has been granted access to an address book, authenticated users are able to access arbitrary contacts of other users. Affected Software ownCloud Server 6.0.3 CVE-2014-3834 Action Taken We reviewed the access-control of the contacts application and ensured that...
Fedora Update for owncloud FEDORA-2014-5918
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...