CVE-2016-1501

Summary: CVE-2016-1501 affects ownCloud Server. Vulnerability allows authenticated remote users to disclose the server installation path via exception messages. Affected versions: ownCloud Server < 8.0.9 and 8.1.x

CVE-2012-5609

The CVE-2012-5609 issue affects ownCloud prior to 4.5.2, with the vulnerability in lib/migrate.php allowing remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file inside a ZIP. Root cause: incomplete blacklist handling in the upload path. Impact per sources...

CVE-2012-5666

CVE-2012-5666 is an XSS vulnerability affecting ownCloud 4.0.x (before 4.0.10) and 4.5.x (before 4.5.5). The issue resides in bookmarks/js/bookmarks.js, enabling remote attackers to inject arbitrary web script or HTML via the PATH_INFO parameter to apps/bookmark/index.php. Proof of impact: cross-...

CVE-2013-0307

CVE-2013-0307 is an XSS vulnerability in ownCloud’s settings.php that allows an administrator to inject arbitrary script/HTML via the group input field. It affects ownCloud servers prior to 4.0.12 and prior to 4.5.7 (4.5.x before 4.5.7). The Root Cause, as documented, is a DOM-based XSS flaw in t...

CVE-2012-4753

CVE-2012-4753 affects ownCloud prior to 4.0.5. The issue is multiple CSRF vulnerabilities that allow remote attackers to hijack user sessions by exploiting authenticated state via unknown vectors. Root cause: CSRF weaknesses in the application before version 4.0.5. Impact: credential/session take...

CVE-2013-0301

CVE-2013-0301 affects ownCloud Calendar CSRF in apps/calendar/ajax/settings/settimezone, allowing remote attackers to hijack user sessions to change timezone. Public details show vulnerable versions: ownCloud before 4.0.12 (and related advisories) with this CSRF in the timezone parameter; impact ...

CVE-2014-3834

OwnCloud CVE-2014-3834 affects OwnCloud Server prior to 6.0.3. The root cause is improper authorization checks where the service does not verify that a user has access permissions, allowing an authenticated user to (1) access another user’s contacts via the address book and (2) rename files via u...

CVE-2014-9044

CVE-2014-9044 relates to ownCloud 7.x prior to 7.0.3, where the Asset Pipeline names the concatenated CSS/JS blob using an MD5 hash of the absolute file paths. This allowed an attacker to brute-force disclose the install path (e.g., /var/www/owncloud/). The root cause is the use of absolute paths...