CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2016-1501
https://notcve.org/view.php?id=CVE-2016-1501
ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages. ownCloud Server en versiones anteriores a 8.0.9 y 8.1.x en versiones anteriores a 8.1.4 permiten a usuarios remotos autenticados obtener información sensible a través de vectores no especificados, lo que revela la ruta de instalación en los mensajes de excepción resultantes. • https://owncloud.org/security/advisory/?id=oc-sa-2016-004 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.5EPSS: 0%CPEs: 7EXPL: 1CVE-2016-1499 – ownCloud 8.2.1 / 8.1.4 / 8.0.9 Information Exposure
https://notcve.org/view.php?id=CVE-2016-1499
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php. ownCloud Server en versiones anteriores a 8.0.10, 8.1.x en versiones anteriores a 8.1.5 y 8.2.x en versiones anteriores a 8.2.2 permite a usuarios remotos autenticados obtener información sensible desde un listado de directorio y posiblemente provocar una denegación de servicio (consumo de CPU) a través del parámetro force en index.php/apps/files/ajax/scan.php. ownCloud versions 8.2.1 and below, 8.1.4 and below, and 8.0.9 and below suffer from an information exposure vulnerability via directory listings. • http://packetstormsecurity.com/files/135158/ownCloud-8.2.1-8.1.4-8.0.9-Information-Exposure.html http://www.securityfocus.com/archive/1/537244/100/0/threaded http://www.securityfocus.com/archive/1/537556/100/0/threaded https://owncloud.org/security/advisory/?id=oc-sa-2016-002 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-062.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5955
https://notcve.org/view.php?id=CVE-2015-5955
ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive credential and cookie information by reading authentication headers. Aplicación ownCloud iOS en versiones anteriores a 3.4.4 no cambia adecuadamente el estado entre múltiples instancias, lo que permite a administradores remotos de instancias obtener información sensible de credencial y cookie mediante lectura de cabeceras de autenticación. • https://owncloud.org/security/advisory/?id=oc-sa-2015-013 • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.1EPSS: 0%CPEs: 3EXPL: 0CVE-2015-7298
https://notcve.org/view.php?id=CVE-2015-7298
ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle (MITM) attacks by leveraging a server using a self-signed certificate. NOTE: this vulnerability exists because of a partial CVE-2015-4456 regression. ownCloud Desktop Client en versiones anteriores a 2.0.1, cuando es compliado con un lanzamiento de Qt en versiones posteriores a 5.3.x, no llama a QNetworkReply::ignoreSslErrors con la lista de errores para ser ignorados, lo que hace más fácil para atacantes remotos llevar a cabo ataques man-in-the-middle (MITM) aprovechando un servidor utilizando un certificado autofirmado. NOTA: esta vulnerabilidad existe a causa de una regresión parcial de CVE-2015-4456. • https://owncloud.org/security/advisory/?id=oc-sa-2015-016 •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2015-7698
https://notcve.org/view.php?id=CVE-2015-7698
icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read function in Share.php. icewind1991 SMB en versiones anteriores a 1.0.3 permite a usuarios remotos autenticados ejecutar comandos SMB arbitrarios a través de metacaracteres de shell en el argumento user en la función (1) listShares en server.php o (2) connect o (3) read en Share.php. • https://github.com/icewind1991/SMB/commit/33ab10cc4d5c3e48cba3a074b5f9fc67590cd032 https://owncloud.org/security/advisory/?id=oc-sa-2015-017 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •