Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
OwncloudOwncloud Server

36 matches found

CVE
CVE•added 2013/08/15 5:55 p.m.•60 views

CVE-2013-1942

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id pa...

4.3CVSS5.6AI score0.09552EPSS
CVE
CVE•added 2015/10/26 2:59 p.m.•59 views

CVE-2015-6670

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

4CVSS6.2AI score0.00176EPSS
CVE
CVE•added 2012/04/20 10:55 a.m.•58 views

CVE-2012-2269

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary field to apps/contacts/ajax/addcard.php, (2) the parameter parameter to apps/contacts/ajax/addproperty.php, (3) the name parameter to apps/...

4.3CVSS5.6AI score0.00855EPSS
CVE
CVE•added 2020/02/17 7:15 p.m.•55 views

CVE-2015-4715

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POS...

4.9CVSS5.1AI score0.01359EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•54 views

CVE-2012-5336

lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.

4CVSS6.3AI score0.00162EPSS
CVE
CVE•added 2014/03/14 4:55 p.m.•54 views

CVE-2013-1963

The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors.

4CVSS6.3AI score0.00176EPSS
CVE
CVE•added 2014/02/05 3:10 p.m.•53 views

CVE-2013-1967

Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter.

4.3CVSS5.9AI score0.00467EPSS
CVE
CVE•added 2015/10/21 6:59 p.m.•53 views

CVE-2015-5954

The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file ...

4CVSS6.2AI score0.00143EPSS
CVE
CVE•added 2012/09/05 11:55 p.m.•52 views

CVE-2012-4394

Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.

4.3CVSS5.8AI score0.00254EPSS
CVE
CVE•added 2012/04/20 10:55 a.m.•51 views

CVE-2012-2398

Cross-site scripting (XSS) vulnerability in files/ajax/download.php in ownCloud before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via the files parameter, a different vulnerability than CVE-2012-2269.4.

4.3CVSS5.6AI score0.00855EPSS
CVE
CVE•added 2013/01/03 1:55 a.m.•51 views

CVE-2012-5665

ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth and user_ldap by editing this file.

4.3CVSS6.9AI score0.00431EPSS
CVE
CVE•added 2014/03/18 5:2 p.m.•51 views

CVE-2013-0201

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parame...

4.3CVSS6AI score0.00421EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•49 views

CVE-2012-5056

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) readyCallback parameter to apps/files_odfviewer/src/webodf/webodf/flashput/PUT.swf, the (2) root parameter to apps/gallery/templates/index.ph...

4.3CVSS5.8AI score0.00263EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•49 views

CVE-2013-0204

settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.

4.6CVSS6.5AI score0.00485EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•49 views

CVE-2014-3833

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function.

4.3CVSS5.9AI score0.00263EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•48 views

CVE-2012-5057

CRLF injection vulnerability in ownCloud Server before 4.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path parameter.

4.3CVSS7.1AI score0.00243EPSS
CVE
CVE•added 2014/03/14 3:55 p.m.•48 views

CVE-2013-0298

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint ...

4.3CVSS5.7AI score0.00263EPSS
CVE
CVE•added 2014/03/14 4:55 p.m.•48 views

CVE-2013-2043

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendar_id parameter.

4CVSS6.3AI score0.00176EPSS
CVE
CVE•added 2015/02/04 6:59 p.m.•48 views

CVE-2014-9047

Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via unknown vectors.

4.3CVSS7AI score0.0025EPSS
CVE
CVE•added 2012/09/05 11:55 p.m.•47 views

CVE-2012-4395

Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter.

4.3CVSS5.6AI score0.00254EPSS
CVE
CVE•added 2012/12/18 1:55 a.m.•47 views

CVE-2012-5608

Cross-site scripting (XSS) vulnerability in apps/user_webdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters.

4.3CVSS5.8AI score0.00295EPSS
CVE
CVE•added 2014/03/14 4:55 p.m.•47 views

CVE-2013-2089

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data.

4.6CVSS7.2AI score0.00391EPSS
CVE
CVE•added 2014/03/24 4:31 p.m.•47 views

CVE-2014-2057

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00263EPSS
CVE
CVE•added 2012/09/05 11:55 p.m.•46 views

CVE-2012-4390

(1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors.

4CVSS6.3AI score0.00199EPSS
CVE
CVE•added 2014/06/05 3:44 p.m.•46 views

CVE-2013-0304

ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to ...

4CVSS6.6AI score0.00176EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•46 views

CVE-2014-3837

The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared files via unspecified vectors.

4CVSS6.3AI score0.00171EPSS
CVE
CVE•added 2013/01/03 1:55 a.m.•45 views

CVE-2012-5666

Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php.

4.3CVSS5.9AI score0.00407EPSS
CVE
CVE•added 2014/03/14 4:55 p.m.•45 views

CVE-2013-2039

Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files via unspecified vectors.

4CVSS6.3AI score0.00139EPSS
CVE
CVE•added 2014/03/24 4:35 p.m.•45 views

CVE-2014-2585

ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration.

4.9CVSS6.2AI score0.00171EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•44 views

CVE-2014-3832

Cross-site scripting (XSS) vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function.

4.3CVSS5.9AI score0.00263EPSS
CVE
CVE•added 2015/02/04 6:59 p.m.•44 views

CVE-2014-9049

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method.

4CVSS6.3AI score0.00176EPSS
CVE
CVE•added 2016/01/08 9:59 p.m.•44 views

CVE-2016-1501

ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages.

4.3CVSS4.1AI score0.00192EPSS
CVE
CVE•added 2012/09/05 11:55 p.m.•43 views

CVE-2012-4396

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to ...

4.3CVSS5.8AI score0.0076EPSS
CVE
CVE•added 2012/12/18 1:55 a.m.•43 views

CVE-2012-5606

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalen...

4.3CVSS5.9AI score0.00442EPSS
CVE
CVE•added 2012/09/05 11:55 p.m.•42 views

CVE-2012-4397

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3) unspec...

4.3CVSS5.8AI score0.00295EPSS
CVE
CVE•added 2014/06/04 2:55 p.m.•42 views

CVE-2014-3838

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts.

4CVSS6.2AI score0.00133EPSS