CVE-2013-0304

ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery CSRF vulnerability, but due to...

CVE-2014-3835

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

Code injection

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...

Code injection

settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings...

Design/Logic Flaw

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts...

Code injection

The document application in ownCloud Server before 6.0.3 uses sequential values for the fileid, which allows remote authenticated users to enumerate shared files via unspecified vectors...

CVE-2014-3963

ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors...

CVE-2012-5336

lib/base.php in ownCloud before 4.0.8 does not properly validate the userid session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV...

CVE-2014-3837

Affected software: ownCloud Server prior to 6.0.3. Vulnerability: the file_id in the documents app is auto-incremented, enabling remote authenticated users to enumerate shared files. Root cause: sequential file_id values used instead of a random access token. Impact: authenticated users could enu...

CVE-2014-3837

The document application in ownCloud Server before 6.0.3 uses sequential values for the fileid, which allows remote authenticated users to enumerate shared files via unspecified vectors...

CVE-2014-3834: Undefined Security Weakness

ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to 1 access the contacts of other users via the address book or 2 rename files via unspecified vectors...

PT-2014-5538

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.16 ownCloud Server versions 6.0.x prior to 6.0.3 Description The issue is related to insufficient permission checks for the files external application, allowing remote authenticated users to add external...

CVE-2014-3946

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors...

CVE-2014-3946

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors...

CVE-2014-3946: Exposure of Sensitive Information to an Unauthorized Actor

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors...

AIX 7.1 TL 3 : X11.base.rte (U860289)

The remote host is missing AIX PTF U860289, which is related to the security of the package X11.base.rte. Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service...

AIX 6.1 TL 9 : X11.base.rte (U860216)

The remote host is missing AIX PTF U860216, which is related to the security of the package X11.base.rte. Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service...

CVE-2014-3933

Cross-site scripting XSS vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field...

Cross site scripting

Cross-site scripting XSS vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field...

CVE-2014-3933

Cross-site scripting XSS vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field...