Lucene search

K

Owncloud Security Vulnerabilities

cve
cve

CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information...

10CVSS

7.2AI Score

0.86EPSS

2023-11-21 10:15 PM
196
In Wild
cve
cve

CVE-2023-49104

An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the...

8.7CVSS

7.5AI Score

0.0005EPSS

2023-11-21 10:15 PM
34
cve
cve

CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

9.8CVSS

9.4AI Score

0.188EPSS

2023-11-21 10:15 PM
58
cve
cve

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public...

7.5CVSS

7.5AI Score

0.001EPSS

2021-02-19 07:15 AM
205
9
cve
cve

CVE-2021-44537

ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code...

7.8CVSS

7.8AI Score

0.011EPSS

2022-01-15 09:15 PM
47
5
cve
cve

CVE-2013-1939

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash)...

6.5AI Score

0.002EPSS

2014-03-14 04:55 PM
25
cve
cve

CVE-2023-24804

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal...

5CVSS

4.7AI Score

0.001EPSS

2023-02-13 05:15 PM
20
cve
cve

CVE-2023-23948

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in FileContentProvider.kt. This issue can lead to information disclosure. Two databases, filelist and owncloud_database, are...

6.2CVSS

5.6AI Score

0.0004EPSS

2023-02-13 05:15 PM
24
cve
cve

CVE-2022-31649

ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or...

7.5CVSS

7.5AI Score

0.001EPSS

2022-06-09 04:15 AM
50
8
cve
cve

CVE-2022-43679

The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof the URL in password-reset e-mail...

5.3CVSS

5.1AI Score

0.001EPSS

2022-11-10 09:15 PM
34
10
cve
cve

CVE-2014-2585

ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount...

6.2AI Score

0.001EPSS

2022-10-03 04:20 PM
18
cve
cve

CVE-2014-3963

ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified...

6.5AI Score

0.001EPSS

2022-10-03 04:20 PM
20
cve
cve

CVE-2012-4753

Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown...

7.4AI Score

0.001EPSS

2022-10-03 04:15 PM
15
cve
cve

CVE-2012-4389

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP...

7.8AI Score

0.005EPSS

2022-10-03 04:15 PM
17
cve
cve

CVE-2012-4752

appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors. NOTE: this can be leveraged by unauthenticated remote attackers using...

6.2AI Score

0.004EPSS

2022-10-03 04:15 PM
28
cve
cve

CVE-2012-4391

Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app...

7.2AI Score

0.001EPSS

2022-10-03 04:15 PM
22
cve
cve

CVE-2012-4396

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to....

5.8AI Score

0.002EPSS

2022-10-03 04:15 PM
18
cve
cve

CVE-2012-4397

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3)...

5.8AI Score

0.002EPSS

2022-10-03 04:15 PM
15
cve
cve

CVE-2012-4392

index.php in ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass authentication via a crafted oc_token cookie...

6.9AI Score

0.005EPSS

2022-10-03 04:15 PM
23
cve
cve

CVE-2012-4394

Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file...

5.8AI Score

0.002EPSS

2022-10-03 04:15 PM
23
cve
cve

CVE-2012-4393

Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5)...

7.2AI Score

0.004EPSS

2022-10-03 04:15 PM
22
cve
cve

CVE-2012-4395

Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url...

5.6AI Score

0.002EPSS

2022-10-03 04:15 PM
18
cve
cve

CVE-2012-4390

(1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified...

6.3AI Score

0.001EPSS

2022-10-03 04:15 PM
19
cve
cve

CVE-2012-5610

Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted...

7.4AI Score

0.005EPSS

2022-10-03 04:15 PM
17
cve
cve

CVE-2012-5608

Cross-site scripting (XSS) vulnerability in apps/user_webdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST...

5.8AI Score

0.002EPSS

2022-10-03 04:15 PM
21
cve
cve

CVE-2012-5666

Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to...

5.9AI Score

0.002EPSS

2022-10-03 04:15 PM
17
cve
cve

CVE-2012-5606

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to...

5.9AI Score

0.003EPSS

2022-10-03 04:15 PM
23
cve
cve

CVE-2012-5609

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP...

7.3AI Score

0.005EPSS

2022-10-03 04:15 PM
19
cve
cve

CVE-2012-5607

The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing...

6.9AI Score

0.002EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2022-25339

ownCloud owncloud/android 2.20 has Incorrect Access Control for local...

5.5CVSS

5.4AI Score

0.0004EPSS

2022-04-07 03:15 PM
64
cve
cve

CVE-2022-25338

ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate...

6.8CVSS

6.6AI Score

0.001EPSS

2022-04-07 02:15 PM
72
cve
cve

CVE-2021-33828

The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share) are supposed to be deleted upon...

8.8CVSS

8.7AI Score

0.001EPSS

2022-01-15 09:15 PM
36
cve
cve

CVE-2021-33827

The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration...

7.2CVSS

7.2AI Score

0.001EPSS

2022-01-15 09:15 PM
33
cve
cve

CVE-2021-40537

Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for...

2.7CVSS

3.8AI Score

0.001EPSS

2021-09-08 06:15 PM
26
cve
cve

CVE-2021-35948

Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled...

5.4CVSS

5.7AI Score

0.001EPSS

2021-09-07 08:15 PM
29
cve
cve

CVE-2021-35946

A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own...

9.8CVSS

9.2AI Score

0.002EPSS

2021-09-07 08:15 PM
26
cve
cve

CVE-2021-35949

The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the...

5.3CVSS

5.5AI Score

0.001EPSS

2021-09-07 07:15 PM
27
cve
cve

CVE-2021-35947

The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the...

5.3CVSS

5.5AI Score

0.002EPSS

2021-09-07 07:15 PM
27
cve
cve

CVE-2021-29659

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

6.5CVSS

6.1AI Score

0.002EPSS

2021-05-20 01:15 PM
37
2
cve
cve

CVE-2020-28646

ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain directories when they were...

7.8CVSS

7.6AI Score

0.001EPSS

2021-02-26 03:15 PM
53
2
cve
cve

CVE-2020-36248

The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this...

4.6CVSS

4.6AI Score

0.001EPSS

2021-02-19 08:15 AM
23
2
cve
cve

CVE-2020-36251

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that...

4.3CVSS

4.5AI Score

0.001EPSS

2021-02-19 07:15 AM
63
10
cve
cve

CVE-2020-10252

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authenticated attacker can interact with local services blindly (aka Blind SSRF) or conduct a Denial Of Service...

8.3CVSS

8AI Score

0.002EPSS

2021-02-19 07:15 AM
63
9
cve
cve

CVE-2020-10254

An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its...

5.9CVSS

5.8AI Score

0.002EPSS

2021-02-19 07:15 AM
66
8
cve
cve

CVE-2020-36250

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the...

6.1CVSS

4.8AI Score

0.001EPSS

2021-02-19 07:15 AM
67
7
cve
cve

CVE-2020-36252

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID...

6.8CVSS

5.5AI Score

0.0004EPSS

2021-02-19 07:15 AM
59
9
cve
cve

CVE-2020-28645

Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data directory in the web root. This affects ownCloud/core versions <...

9.1CVSS

9AI Score

0.001EPSS

2021-02-09 07:15 PM
22
2
cve
cve

CVE-2020-28644

The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownCloud/core version <...

4.3CVSS

4.8AI Score

0.001EPSS

2021-02-09 07:15 PM
24
2
cve
cve

CVE-2020-16144

When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user uploads a virus the files antivirus app would detect the virus but fails to delete it due to permission issues. This affects the...

5.7CVSS

5.5AI Score

0.001EPSS

2021-02-09 06:15 PM
21
2
cve
cve

CVE-2020-16255

ownCloud (Core) before 10.5 allows XSS in login page 'forgot...

6.1CVSS

5.9AI Score

0.001EPSS

2021-01-15 06:15 PM
80
1
Total number of security vulnerabilities167