CVE-2012-5057

CVE-2012-5057 describes a CRLF injection vulnerability in ownCloud Server

CVE-2013-0300

CVE-2013-0300 affects ownCloud 4.5.x (before 4.5.7) and related versions, introducing multiple CSRF vulnerabilities in endpoints such as apps/calendar/ajax/changeview.php, apps/files_external/ajax/, and apps/user_webdavauth/settings.php. The flaws allow remote attackers to hijack user authenticat...

CVE-2013-0302

CVE-2013-0302 affects ownCloud Server prior to 4.0.12 and is an information-disclosure vulnerability linked to the inclusion of the Amazon SDK testing suite. The vulnerability allows remote attackers to obtain sensitive server information via unspecified vectors, with the evidence focusing on det...

CVE-2013-2045

CVE-2013-2045 affects ownCloud Server prior to 5.0.6 (and related advisory notes) where lib/db.php does not neutralize special elements passed to SQL queries, enabling SQL injection by remote authenticated users. The issue is limited to authenticated access and the impact is described as arbitrar...

CVE-2012-2398

CVE-2012-2398 describes a cross-site scripting (XSS) vulnerability in the ownCloud project. The flaw resides in the files/ajax/download.php endpoint and allows remote attackers to inject arbitrary web script or HTML via the files parameter, affecting versions prior to 3.0.3. The underlying issue ...

CVE-2012-4389

CVE-2012-4389 affects ownCloud Server before 4.0.7 due to an incomplete blacklist in lib/migrate.php, enabling remote code execution by uploading a crafted .htaccess inside an import.zip and accessing a PHP file. Impact: arbitrary code execution on affected servers. Mitigation: upgrade to ownClou...

CVE-2012-4390

CVE-2012-4390 affects ownCloud Server prior to version 4.0.7. The issue resides in (1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php, enabling remote authenticated users to enumerate registered users via unspecified vectors. The root cause is not fully detailed in the ...

CVE-2012-5056

OwnCloud Server prior to 4.0.8 is affected by multiple XSS vulnerabilities. The issues allow remote attackers to inject arbitrary script/HTML via three vectors: (1) readyCallback in apps/files_odfviewer/src/webodf/webodf/flashput/PUT.swf, (2) root parameter to apps/gallery/templates/index.php, an...

CVE-2012-5665

Affected software: ownCloud 4.0.x (before 4.0.10) and 4.5.x (before 4.5.5). Vulnerability: improper restriction of access to settings.php, enabling remote attackers to edit app configurations for user_webdavauth and user_ldap by editing this file. Root cause: settings.php access is not properly g...

CVE-2013-1822

ownCloud 4.5.x before 4.5.8 is affected by multiple XSS vulnerabilities (CVE-2013-1822). The flaws allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via (1) quota parameter to /core/settings/ajax/setquota.php, (2) group field to settings.php, or...

CVE-2013-2043

CVE-2013-2043 affects ownCloud calendar handling: the script apps/calendar/ajax/events.php fails to properly verify calendar ownership, enabling remote authenticated users to download arbitrary calendars via the calendar_id parameter. Affected versions are ownCloud before 4.5.11 and 5.x before 5....

CVE-2012-2397

CVE-2012-2397 affects ownCloud prior to version 3.0.3. The vulnerability is a Cross-site request forgery (CSRF) that enables remote attackers to hijack the authentication of arbitrary users by crafting requests that insert cross-site scripting (XSS) sequences via vectors involving the contacts fe...

CVE-2012-4395

CVE-2012-4395 is a cross-site scripting (XSS) vulnerability in ownCloud’s index.php that is exploitable via the redirect_url parameter, affecting ownCloud server versions before 4.0.3. The vulnerability is described as a reflected XSS (no specific exploit details provided in the documents). Remed...

CVE-2013-0298

OwnCloud 4.5.x is vulnerable to multiple XSS via (1) an iCalendar file in the calendar app, (2) the dir or (3) file parameters to apps/files_pdfviewer/viewer.php, or (4) the mountpoint parameter to /apps/files_external/addMountPoint.php. Root cause: improper handling of untrusted input in these c...

CVE-2013-0304

CVE-2013-0304 affects ownCloud Server prior to 4.5.7. The calendar export path (/apps/calendar/export.php) is vulnerable because ownership of calendars is not properly checked, allowing remote authenticated users to read arbitrary calendars via the calid parameter. This is described as a calendar...

CVE-2013-2047

The CVE-2013-2047 entry concerns ownCloud Server versions earlier than 5.0.6, where the login page (index.php) does not disable the password field’s autocomplete. This configuration allows physically proximate attackers to obtain passwords via browsers that support autocomplete. Public references...

CVE-2013-2086

The CVE-2013-2086 issue affects ownCloud 5.0.x prior to 5.0.6, where the configuration loader writes CSRF tokens (and other private data) into an accessible JavaScript file. This leakage enables remote attackers to obtain CSRF tokens and other sensitive information, per the official advisory and ...

CVE-2013-2089

CVE-2013-2089 affects ownCloud up to version 5.0.6, where an incomplete blacklist in file upload handling allows authenticated remote users to execute arbitrary PHP code by uploading a crafted file and then requesting it directly from /data. The issue originates from insufficient validation of up...

CVE-2014-3837

Affected software: ownCloud Server prior to 6.0.3. Vulnerability: the file_id in the documents app is auto-incremented, enabling remote authenticated users to enumerate shared files. Root cause: sequential file_id values used instead of a random access token. Impact: authenticated users could enu...

CVE-2012-5608

CVE-2012-5608 describes a cross-site scripting (XSS) vulnerability in ownCloud’s web authentication module. The issue arises in the file path apps/user_webdavauth/settings.php for ownCloud versions 4.5.x prior to 4.5.2, allowing remote attackers to inject arbitrary web script or HTML via arbitrar...

CVE-2013-1941

Summary: CVE-2013-1941 affects ownCloud Server prior to versions 4.0.14, 4.5.x prior to 4.5.9, and 5.0.x prior to 5.0.4. The installation routine used the time() function as the seed for generating the PostgreSQL database user password, producing very low entropy and making brute-force guessing m...

CVE-2013-2039

CVE-2013-2039 affects ownCloud: directory traversal in lib/files/view.php allows remote authenticated users to access arbitrary files. Vulnerable versions: < 4.0.15, < 4.5.11 for the 4.5.x line, and

CVE-2013-2040

CVE-2013-2040 corresponds to multiple XSS vulnerabilities in ownCloud. Affected are ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6, where remote authenticated users can inject arbitrary web script or HTML via unspecified vectors. Connected sources corroborate the vulnerabilit...

CVE-2014-4929

CVE-2014-4929 affects ownCloud Server via a Local File Inclusion in the routing component caused by improper control of the filename for a require_once() in the routing code. Affected versions are ownCloud Server < 5.0.17 and

CVE-2013-2046

CVE-2013-2046 affects ownCloud Server: SQL injection in lib/bookmarks.php. Vulnerable in 4.5.x before 4.5.11 and 5.x before 5.0.6. Root cause: unsafely constructed SQL via bookmarks feature, allowing remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Impact per ...

CVE-2013-7344

CVE-2013-7344 affects the ownCloud project, specifically the file core/settings.php in versions older than 4.0.12 and older than 4.5.6 where an issue allowed remote authenticated users to execute arbitrary PHP code via unknown vectors. This vulnerability is the split from CVE-2013-0303 (core/ajax...

CVE-2014-2052

CVE-2014-2052 affects Zend Framework used by ownCloud Server. The vulnerability is triggered by an XML External Entity (XXE) attack in Zend Framework that can allow a remote attacker to read arbitrary files, cause a denial of service, and potentially other impacts. Affected products/versions are ...

CVE-2014-9048

The CVE-2014-9048 entry concerns ownCloud Server’s documents application, where the vulnerability arises from missing access control in the API. Affected versions are ownCloud Server < 6.0.6 (i.e., 6.x prior to 6.0.6) and

CVE-2012-4396

CVE-2012-4396 involves multiple reflected XSS vulnerabilities in ownCloud prior to 4.0.2. The description lists the vulnerable vectors and parameters across various modules: file names in apps/user_ldap/settings.php; url and/or title in apps/bookmarks/ajax/editBookmark.php; tag/page in apps/bookm...

CVE-2013-0297

CVE-2013-0297 concerns multiple XSS flaws in ownCloud prior to 4.0.12 and 4.5.x prior to 4.5.7. The vulnerabilities allow remote authenticated administrators to inject arbitrary script/HTML via the site_name or site_url parameters to apps/external/ajax/setsites.php. Connected sources confirm affe...

CVE-2013-0299

CVE-2013-0299 is a set of CSRF vulnerabilities in ownCloud affecting versions before 4.0.12 and 4.5.x before 4.5.7. The issues enable an attacker to hijack user sessions via requests that alter settings: (1) change user timezone (lat/lng) via apps/calendar/ajax/settings/guesstimezone.php, (2) tog...

CVE-2013-1851

CVE-2013-1851 affects ownCloud server via an incomplete blacklist in lib/migrate.php. Affected versions are before 4.0.13 and before 4.5.8 (4.5.x). When user_migrate is enabled, remote authenticated users can import arbitrary files into their own account via unspecified vectors. Root cause is imp...

CVE-2013-2150

CVE-2013-2150 affects ownCloud’s viewer.js (js/viewer.js) across versions prior to 4.5.12 and 5.x prior to 5.0.7, enabling remote XSS via shared-files vectors. Multiple connected advisories corroborate these XSS issues and cite the affected versions and files (viewer.js and core/js/oc-dialogs.js)...

CVE-2014-2051

CVE-2014-2051 affects ownCloud Server prior to 5.0.15 and 6.0.x prior to 6.0.2. The vulnerability enables remote attackers to perform an LDAP injection attack via unspecified vectors during login, in the authentication flow. Root cause: improper handling of LDAP queries in the login process. Impa...

CVE-2014-2057

CVE-2014-2057 affects the open-source file sync and share platform ownCloud . The vulnerability is described as multiple XSS vulnerabilities in versions before 6.0.2 , allowing remote attackers to inject arbitrary web script or HTML through unspecified vectors. The root cause is cross-site script...

CVE-2014-9045

Summary: CVE-2014-9045 affects the ownCloud Server FTP backend in the external user_External backend. The flaw arises because the FTP backend did not URL-encode credentials, allowing a remote attacker to bypass authentication with a crafted password. Affected versions (per sources): ownCloud Serv...

CVE-2012-5606

OwnCloud contains multiple XSS vulnerabilities in versions before 4.0.9 and 4.5.0. The flaws allow remote injection of arbitrary scripts/HTML via (1) file name in apps/files_versions/js/versions.js, (2) apps/files/js/filelist.js, or (3) event title in 3rdparty/fullcalendar/js/fullcalendar.js. Roo...

CVE-2014-2585

CVE-2014-2585 affects ownCloud before 5.0.15 and 6.x before 6.0.2. When the file_external app is enabled, remote authenticated users can mount the local filesystem in the user’s ownCloud via the mount configuration. Affected versions include 5.x up to 5.0.14 and 6.x up to 6.0.1. Remediation per c...

CVE-2014-3836

ownCloud Server

CVE-2014-3838

Summary (Concrete details from provided documents): The CVE-2014-3838 issue affects ownCloud Server before 5.0.16 and 6.0.x before 6.0.3. The root cause is improper authorization checks in the core, allowing remote authenticated users with access to multiple accounts to read the names of files be...

CVE-2014-9049

The CVE-2014-9049 entry concerns ownCloud Server’s Documents application. Affected are ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3. The root issue is a legacy debugging/API method that allowed remote authenticated users to obtain all valid session IDs, enabling access to resources tied ...

CVE-2016-1501

Summary: CVE-2016-1501 affects ownCloud Server. Vulnerability allows authenticated remote users to disclose the server installation path via exception messages. Affected versions: ownCloud Server < 8.0.9 and 8.1.x

CVE-2013-2041

Vulnerability summary (CVE-2013-2041) : ownCloud 5.0.x is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to inject arbitrary web script or HTML. The flaw is triggered by unescaped user-provided input in two locations: (1) the tag parameter to...

CVE-2014-3835

The CVE-2014-3835 entry concerns ownCloud Server where the files_external application does not properly check user permissions. Affected are ownCloud Server < 5.0.16 and

CVE-2014-9042

CVE-2014-9042 is an XSS in the import functionality of the ownCloud bookmarks app, affecting versions prior to 5.0.18, 6.x prior to 6.0.6, and 7.x prior to 7.0.3. The vulnerability allows remote authenticated users to inject arbitrary script/HTML by importing a link with an unspecified protocol. ...

CVE-2014-9046

The CVE-2014-9046 case affects ownCloud Server: OC_Util::getUrlContent() can be abused to read arbitrary local files via file:// redirects in affected releases (ownCloud Server < 5.0.18, 6.x < 6.0.6, 7.x

CVE-2016-1498

CVE-2016-1498 is an XSS vulnerability in the ownCloud Server OCS discovery provider. It affects the OCS discovery provider component prior to: 7.0.12, 8.0.x prior to 8.0.10, 8.1.x prior to 8.1.5, and 8.2.x prior to 8.2.2, allowing remote attackers to inject arbitrary script via URL vectors. Multi...

CVE-2016-1500

CVE-2016-1500 affects ownCloud Server releases prior to certain patch levels (7.0.12; 8.0.x < 8.0.10; 8.1.x < 8.1.5; 8.2.x

CVE-2012-4397

CVE-2012-4397 affects ownCloud prior to 4.0.1. The issue is multiple XSS vulnerabilities in the calendar and contacts modules: (1) calendar displayname fields (part.choosecalendar.rowfields.php and part.choosecalendar.rowfields.shared.php) and (2) unspecified vectors in apps/contacts/lib/vcard.ph...

CVE-2014-3832

CVE-2014-3832 is an XSS vulnerability in the Documents component of ownCloud Server 6.0.x before 6.0.3. The issue allows an attacker to inject arbitrary web script or HTML via unspecified vectors, with the root cause possibly related to the print_unescaped function. Public references indicate aff...