CVSS: 6.5EPSS: 0%CPEs: 22EXPL: 0CVE-2013-7344
https://notcve.org/view.php?id=CVE-2013-7344
Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this issue was SPLIT from CVE-2013-0303 due to different affected versions. Vulnerabilidad no especificada en core/settings.php en ownCloud anterior a 4.0.12 y 4.5.x anterior a 4.5.6 permite a usuarios remotos autenticados ejecutar código PHP arbitrario a través de vectores desconocidos. NOTA: este problema fue separado de CVE-2013-0303 debido a diferentes versiones afectadas. • http://owncloud.org/about/security/advisories/oC-SA-2013-006 •
CVSS: 4.3EPSS: 0%CPEs: 53EXPL: 0CVE-2014-2057
https://notcve.org/view.php?id=CVE-2014-2057
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en ownCloud anterior a 6.0.2 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2014-007 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 2CVE-2013-0201
https://notcve.org/view.php?id=CVE-2013-0201
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php. Múltiples vulnerabilidades de XSS en ownCloud 4.5.5, 4.0.10 y versiones anteriores permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de la (1) QUERY_STRING a core/lostpassword/templates/resetpassword.php, (2) parámetro mime a apps/files/ajax/mimeicon.php o (3) parámetro token a apps/gallery/sharing.php • http://osvdb.org/89505 http://osvdb.org/89506 http://osvdb.org/89511 http://owncloud.org/about/security/advisories/oC-SA-2013-001 https://exchange.xforce.ibmcloud.com/vulnerabilities/81475 https://github.com/owncloud/core/commit/4e2b834 https://github.com/owncloud/core/commit/b8e0309 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 16EXPL: 0CVE-2013-0301
https://notcve.org/view.php?id=CVE-2013-0301
Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter. Vulnerabilidad de CSRF en apps/calendar/ajax/settings/settimezone en ownCloud anterior a 4.0.12 permite a atacantes remotos secuestrar la autenticación de usuarios para solicitudes que cambian la zona horaria a través del parámetro timezone. • http://owncloud.org/about/security/advisories/oC-SA-2013-004 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2013-0300
https://notcve.org/view.php?id=CVE-2013-0300
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php. Múltiples vulnerabilidades de CSRF en ownCloud 4.5.x anterior a 4.5.7 permiten a atacantes remotos secuestrar la autenticación de usuarios para solicitudes que (1) cambian la vista por defecto a través del parámetro v hacia apps/calendar/ajax/changeview.php, montar carpetas arbitrarias de (2) Google Drive o (3) Dropbox a través de vectores relacionados con addRootCertificate.php, dropbox.php y google.php en apps/files_external/ajax/ o (4) cambian la URL del servidor de autenticación a través de vectores no especificados hacia apps/user_webdavauth/settings.php. • http://owncloud.org/about/security/advisories/oC-SA-2013-004 • CWE-352: Cross-Site Request Forgery (CSRF) •