1950 matches found
WebDAV Api Authentication Bypass using Pre-Signed URLs - ownCloud
It is possible to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured which is the default...
Disclosure of sensitive credentials and configuration in containerized deployments - ownCloud
The “graphapi” app relies on a third-party library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information includes all the environment variables of the webserver. In containerized deployments, these environment variabl...
Subdomain Validation Bypass - ownCloud
Within the oauth2 app an attacker is able to pass in a specially crafted redirect-url which bypasses the validation code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker...
CVE-2023-49104
An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker...
CVE-2023-49105
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...
CVE-2023-49105
CVE-2023-49105 — ownCloud core vulnerability (pre-signed URLs) highly critical . In ownCloud core prior to 10.13.1, an attacker who knows a victim’s username and if the victim has no signing-key configured can access, modify, or delete any file without authentication because pre-signed URLs are a...
ownCloud Security Breach
ownCloud is a personal cloud storage solution from US-based ownCloud, Inc. A security vulnerability exists in ownCloud core versions 10.6.0 through 10.13.0, which can be exploited to bypass WebDAV Api authentication using a pre-signed URL...
CVE-2023-49105
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...
ownCloud Security Breach
ownCloud is a suite of personal cloud storage solutions from the US-based company ownCloud. A security vulnerability exists in ownCloud graphapi versions prior to 0.2.1, 0.3.1 and 0.3.1. The vulnerability stems from the fact that the graphapi application relies on the third-party GetPhpInfo.php...
CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
CVE-2023-49104
An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker...
CVE-2023-49104
CVE-2023-49104 affects ownCloud’s OAuth2 component (versions before 0.6.1) where enabling “Allow Subdomains” lets an attacker craft a redirect-url that bypasses validation, enabling callbacks to a top‑level domain controlled by the attacker. Documents consistently state the impact as redirection ...
PT-2023-7321 · Owncloud · Owncloud
Name of the Vulnerable Software and Affected Versions: ownCloud owncloud/oauth2 versions prior to 0.6.1 Description: The issue is related to the "Allow Subdomains" configuration in the OAuth2 authorization platform, which is associated with access control weaknesses. An attacker can exploit this ...
PT-2023-7082
Name of the Vulnerable Software and Affected Versions ownCloud owncloud/graphapi versions 0.2.x through 0.2.0 and versions 0.3.x through 0.3.0 Description The issue is related to the graphapi app in ownCloud, which relies on a third-party GetPhpInfo.php library. This library provides a URL that,...
CVE-2023-49103
The CVE-2023-49103 vulnerability affects ownCloud graphapi in versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The issue stems from a third‑party GetPhpInfo.php that returns a phpinfo() output, exposing the PHP environment and webserver variables (potentially including admin passwords, mail cr...
ownCloud Phpinfo Reader
Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app graph installed contain a test file which prints phpinfo to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter. Docker m...
MAL-2023-1505 Malicious code in owncloud-js-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26163abe3e5a983c952c08703d6b6763543c0fc989b54027001520a78d7b145a The OpenSSF Package Analysis project identified 'owncloud-js-dev' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in owncloud-js-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26163abe3e5a983c952c08703d6b6763543c0fc989b54027001520a78d7b145a The OpenSSF Package Analysis project identified 'owncloud-js-dev' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
ownCloud: Federated share permissions can be increased by recipient
The federated share permissions in Nextcloud allowed recipients to increase their permissions by sending a request to the server with the share token and ID, resulting in a security vulnerability...