PT-2012-5365

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.7 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations. Recommendations For versions prior to 4.0.7,...

PT-2012-5575

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.6 Description The issue allows remote authenticated users to edit app configurations due to improper access restrictions in the appconfig.php file. This can potentially be exploited by unauthenticated remote...

PT-2012-5364

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.7 Description The issue allows remote authenticated users to enumerate the registered users via unspecified vectors, specifically affecting the "apps/calendar/appinfo/remote.php" and...

PT-2012-5366

Name of the Vulnerable Software and Affected Versions ownCloud version 4.0.7 Description The issue concerns improper validation of the oc token cookie in the index.php file, allowing remote attackers to bypass authentication by crafting a specific oc token cookie value. Recommendations For ownClo...

PT-2012-5369

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the redirect url parameter in the index.php...

PT-2012-5368

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the file parameter in the...

PT-2012-5367

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.6 Description The issue affects ownCloud, allowing remote attackers to hijack the authentication of arbitrary users for various requests. This is due to multiple cross-site request forgery CSRF vulnerabilities in...

PT-2012-5576

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.5 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of victims via unknown vectors. Recommendations...

PT-2012-5363

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.7 Description The issue allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file. This is due to an incomplete blacklist...

CVE-2012-4392: Improper Authentication

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

CVE-2012-4390: Exposure of Sensitive Information to an Unauthorized Actor

1 apps/calendar/appinfo/remote.php and 2 apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors...

CVE-2012-4396: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 file names to apps/userldap/settings.php; 2 url or 3 title parameter to apps/bookmarks/ajax/editBookmark.php; 4 tag or 5 page parameter to...

CVE-2012-4753: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-4397: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...

CVE-2012-4393: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

CVE-2012-4752: Undefined Security Weakness

appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors. NOTE: this can be leveraged by unauthenticated remote attackers using CVE-2012-4393...

CVE-2012-4391: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations...

CVE-2012-4389: Undefined Security Weakness

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file...

CVE-2012-4394: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2012-4395: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirecturl parameter...