Page 12 of 138 results (0.002 seconds)

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 4

CVE-2014-1665 – ownCloud 6.0.0a - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2014-1665

06 Feb 2014 — Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file. Vulnerabilidad Cross-Site Scripting (XSS) en ownCloud en versiones anteriores a la 6.0.1 permite que atacantes remotos autenticados inyecten scripts web o HTLM arbitrarios mediante el nombre de archivo de un archivo subido. ownCloud version 6.0.0a suffers from file deletion, cross site request forgery, and cross site scripting vulner... • https://packetstorm.news/files/id/125086 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 86EXPL: 1

CVE-2013-1967

https://notcve.org/view.php?id=CVE-2013-1967

05 Feb 2014 — Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter. Vulnerabilidad de XSS en flashmediaelement.swf en MediaElement.js anterior a 2.11.2, utilizado en OwnCloud Server 5.0.x anterior a 5.0.5 y 4.5.x anterior a 4.5.10, permite a atacantes remotos inyectar script Web o HTML arbitrario a través del parámetro f... • http://owncloud.org/about/security/advisories/oC-SA-2013-017 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.1EPSS: 0%CPEs: 13EXPL: 0

CVE-2013-6403 – Mandriva Linux Security Advisory 2013-289

https://notcve.org/view.php?id=CVE-2013-6403

19 Dec 2013 — The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB. La página de administración de ownCloud anteriores a 5.0.13 permite a atacantes remotos sortear restricciones de acceso intencionadas a través de vectores no especificados, relacionados con MariaDB. Possible security bypass on admin page under certain circumstances and MariaDB. The owncloud package has been updated to version 5.0.13, fixing this and many other ... • http://owncloud.org/changelog • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.5EPSS: 9%CPEs: 112EXPL: 2

CVE-2013-1942 – jPlayer - 'Jplayer.swf' Script Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2013-1942

15 Aug 2013 — Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023. Múltiples vulnerabilidades de XSS en actionscript/Jplayer.as en el componente... • https://www.exploit-db.com/exploits/38460 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0

CVE-2013-2149 – Mandriva Linux Security Advisory 2013-175

https://notcve.org/view.php?id=CVE-2013-2149

18 Jun 2013 — Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files. Múltiples vulnerabilidades de XSS en ownCloud anterior a 4.0.16 y 5.x anterior a 5.0.7 permiten a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a través de vectores relacionados con archivos compartidos. Cross-site scripting vulnerabilities in js/viewer.js inside the files_videovi... • http://owncloud.org/about/security/advisories/oC-SA-2013-028 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0

CVE-2013-2150 – Mandriva Linux Security Advisory 2013-175

https://notcve.org/view.php?id=CVE-2013-2150

18 Jun 2013 — Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files. Múltiples vulnerabilidades de XSS en js/viewer.js en ownCloud anterior a 4.5.12 y 5.x anterior a 5.0.7 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores relacionados con archivos compartidos. Cross-site scripting vulnerabilities in js/viewer.js inside the fil... • http://owncloud.org/about/security/advisories/oC-SA-2013-028 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0

CVE-2012-5666

https://notcve.org/view.php?id=CVE-2012-5666

03 Jan 2013 — Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en bookmarks/js/bookmarks.js en ownCloud v4.0.x antes de v4.0.10 y v4.5.x antes de v4.5.5 permite a atacantse remotos inyectar secuencias de comandos web o HTML a través de PATH_INFO a apps/bookmark/... • http://owncloud.org/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 1

CVE-2012-5665

https://notcve.org/view.php?id=CVE-2012-5665

03 Jan 2013 — ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth and user_ldap by editing this file. ownCloud v4.0.x antes de v4.0.10 y v4.5.x antes de v4.5.5 no restringe el acceso a settings.php, lo que permite a atacantes remotos editar las configuraciones de aplicaciones de user_webdavauth y user_ldap modificando este archivo. • http://owncloud.org/changelog • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0

CVE-2012-5606

https://notcve.org/view.php?id=CVE-2012-5606

18 Dec 2012 — Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.9 y v4.5.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a tr... • http://owncloud.org/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.1EPSS: 0%CPEs: 14EXPL: 0

CVE-2012-5607

https://notcve.org/view.php?id=CVE-2012-5607

18 Dec 2012 — The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack." La funcionalidad de reinicio "Contraseña olvidada" en ownCloud v4.0.9 y antes de v4.5.0 no comprueba correctamente el token de seguridad, lo que permite a atacantes remotos para cambiar la contraseña de las cuentas a través de vectores no especificados relacionados con u... • http://owncloud.org/changelog • CWE-255: Credentials Management Errors •