CVE-2020-16144

The CVE-2020-16144 issue affects ownCloud's files_antivirus component versions before 0.15.2 when using object storage (e.g., S3) as the file store. If a user creates a public link to a folder allowing anonymous uploads and another user uploads a virus, the antivirus detects the malware but canno...

OwnCloud 输入验证错误漏洞

Owncloud ownCloud is a set of personal cloud storage solutions from the American company ownCloud Owncloud. An input validation error vulnerability exists in OwnCloud Core, which arises from a network system or product that does not properly validate incoming data. No detailed vulnerability detai...

Owncloud 安全漏洞

Owncloud ownCloud is a set of personal cloud storage solutions from the American company ownCloud Owncloud. A security vulnerability exists in versions of OwnCloud prior to 0.15.2, which originates when a user creates a public link to a folder where an anonymous user uploads a file, and another...

ownCloud < 10.5 XSS Vulnerability

ownCloud is prone to a reflected cross-site scripting vulnerability in the forgot password funcionallity. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2020-16255

ownCloud Core before 10.5 allows XSS in login page 'forgot password.'...

CVE-2020-16255

ownCloud Core before 10.5 allows XSS in login page 'forgot password.'...

ALPINE-CVE-2020-16255

ownCloud Core before 10.5 allows XSS in login page 'forgot password.'...

Default credentials

ownCloud Core before 10.5 allows XSS in login page 'forgot password.'...

CVE-2020-16255

ownCloud Core before 10.5 allows XSS in login page 'forgot password.'...

CVE-2020-16255

ownCloud Core before 10.5 allows XSS in login page 'forgot password.'...

CVE-2020-16255

ownCloud Core prior to 10.5 is affected by a reflected XSS in the login page forgot-password flow. The issue stems from insufficient input sanitization on the forgot-password path, enabling injection of script via the error/exception flow. Affected product/version: ownCloud Core

ownCloud < 10.3.2 SSRF Vulnerability

ownCloud is prone to a server-side request forgery SSRF vulnerability in the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ownCloud < 10.3.0 Group Share Deletion Vulnerability

ownCloud is prone to a vulnerability where it is possible to delete a received group share for whole group. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

ownCloud 10.0.9 < 10.3.1 File Permission Vulnerability

ownCloud is prone to a vulnerability where it is possible to access all file versions of a user. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

ownCloud < 10.4 Access Control Vulnerability

ownCloud is prone to an access control vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud < 10.2.1 Share Permission Vulnerability

ownCloud is prone to a vulnerability where it is possible to extend internal-share permissions using the API. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier...

Reflected XSS in login page forgot password functionallity

The login page was not properly sanitizing exception messages from the ownCloud server...

Bypassing App Lock (Pattern/Passcode/Fingerprint lock | Android) (oC-SA-2020-003)

Given an attacker has physical access, creating a backup of the ownCloud Android app via adb provides access to the app preferences file. Contained in the file were settings related to the app lock feature such as the pincode/pattern and if the respective lock is active. An attacker could change...

Bypassing File Firewall (oC-SA-2020-002)

Platform: ownCloud Server Versions: n/a Date: 8/3/2020 Risk: Low CVSS v3 Base Score: 1.6 CVSS v3 Vector: AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N CWE ID: CWE-791 CWE Name: Incomplete Filtering of Special Elements...

ownCloud: Remote Code Execution through "Files_antivirus" plugin

Hi, I would like to report a Remote Code Execution in OwnCloud. The flaw is exploitable as an authenticated user and level of privileges required is "Administrator". Vulnerable component is the plugin "filesantivirus", freely downloadable via the market and available in owncloud github repository...