CVSS: 8.8EPSS: 0%CPEs: 25EXPL: 0CVE-2013-1850
https://notcve.org/view.php?id=CVE-2013-1850
14 Mar 2014 — Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file. Múltiples vulnerabilidades de lista negra incompleta en (1) import.php y (2) ajax/uploadimport.php en apps/contacts/ en ownCloud anterior a 4.0.13 y 4.5.x anterior a 4.5.8 permiten a usuarios remotos autenticados ejecutar código PHP arbitrario mediante la s... • http://owncloud.org/about/security/advisories/oC-SA-2013-009 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 25EXPL: 0CVE-2013-1851
https://notcve.org/view.php?id=CVE-2013-1851
14 Mar 2014 — Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors. Vulnerabilidad de lista negra incompleta en lib/migrate.php en ownCloud anterior a 4.0.13 y 4.5.x anterior a 4.5.8, cuando la aplicación user-migrate está habilitada, permite a usuarios remotos autenticados importar archivos arbitrarios a la cuenta del us... • http://owncloud.org/about/security/advisories/oC-SA-2013-010 •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2013-1939
https://notcve.org/view.php?id=CVE-2013-1939
14 Mar 2014 — The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character. El plugin HTML\Browser en SabreDAV anterior a 1.6.9, 1.7.x anterior a 1.7.7 y 1.8.x anterior a 1.8.5, utilizado en ownCloud, cuando se ejecuta en Windows, no comprueba debidamente los separadores de rutas en la ruta base, lo que ... • http://owncloud.org/about/security/advisories/oC-SA-2013-016 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 15EXPL: 0CVE-2013-1963
https://notcve.org/view.php?id=CVE-2013-1963
14 Mar 2014 — The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors. La aplicación de contactos en ownCloud anterior a 4.5.10 y 5.x anterior a 5.0.5 no comprueba debidamente la propiedad de contactos, lo que permite a usuarios remotos autenticados descargar contactos arbitrarios a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2013-018 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2014-2047
https://notcve.org/view.php?id=CVE-2014-2047
14 Mar 2014 — Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de fijación de sesión en ownCloud anterior a 6.0.2, cuando PHP está configurado para aceptar parámetros de sesión mediante una solicitud GET, permite a atacantes remotos secuestrar sesiones web a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2014-001 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 52EXPL: 0CVE-2014-2049
https://notcve.org/view.php?id=CVE-2014-2049
14 Mar 2014 — The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors. Las políticas de Flash Cross Domain por defecto en ownCloud anterior a 5.0.15 y 6.x anterior a 6.0.2 permite a atacantes remotos acceder a archivos de usuario a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2014-003 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 31EXPL: 0CVE-2013-2039
https://notcve.org/view.php?id=CVE-2013-2039
14 Mar 2014 — Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en lib/files/view.php en ownCloud anterior a 4.0.15, 4.5.x 4.5.11 y 5.x anterior a 5.0.6 permite a usuarios remotos autenticados acceder a archivos arbitrarios a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2013-020 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.8EPSS: 0%CPEs: 23EXPL: 0CVE-2013-0297
https://notcve.org/view.php?id=CVE-2013-0297
14 Mar 2014 — Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php. Múltiples vulnerabilidades de XSS en ownCloud anterior a 4.0.12 y 4.5.x anterior a 4.5.7 permiten a administradores remotos autenticados inyectar script Web o HTML arbitrarios a través del parámetro (1) site_name o (2) site_url hacia apps/externa... • http://owncloud.org/about/security/advisories/oC-SA-2013-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2013-0298
https://notcve.org/view.php?id=CVE-2013-0298
14 Mar 2014 — Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php. Múltiples vulnerabilidades de XSS en ownCloud 4.5.x anterior a 4.5.7 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través de (1) un arch... • http://owncloud.org/about/security/advisories/oC-SA-2013-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 23EXPL: 0CVE-2013-0307
https://notcve.org/view.php?id=CVE-2013-0307
14 Mar 2014 — Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter. Vulnerabilidad de XSS en settings.php en ownCloud anterior a 4.0.12 y 4.5.x anterior a 4.5.7 permite a administradores remotos inyectar script Web o HTML arbitrarios a través del parámetro del campo de entrada group. • http://owncloud.org/about/security/advisories/oC-SA-2013-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •