CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2012-5666
https://notcve.org/view.php?id=CVE-2012-5666
Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en bookmarks/js/bookmarks.js en ownCloud v4.0.x antes de v4.0.10 y v4.5.x antes de v4.5.5 permite a atacantse remotos inyectar secuencias de comandos web o HTML a través de PATH_INFO a apps/bookmark/index.php. • http://owncloud.org/changelog http://secunia.com/advisories/51614 http://www.openwall.com/lists/oss-security/2012/12/22/2 http://www.openwall.com/lists/oss-security/2012/12/22/5 http://www.securityfocus.com/bid/57030 https://github.com/owncloud/apps/commit/eafa9b2 https://github.com/owncloud/core/commit/b24c929cc0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2012-5606
https://notcve.org/view.php?id=CVE-2012-5606
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.9 y v4.5.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) nombre de archivo a apps/files_versions/js/versions.js (2) apps/files/js/filelist.js o (3) titulo del evento a 3rdparty/fullcalendar/js/fullcalendar.js. • http://owncloud.org/changelog http://owncloud.org/security/advisories/oc-sa-2012-001 http://secunia.com/advisories/51357 http://www.openwall.com/lists/oss-security/2012/11/30/3 https://github.com/owncloud/core/commit/ce66759 https://github.com/owncloud/core/commit/e45f36c https://github.com/owncloud/core/commit/e5f2d46 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 14EXPL: 0CVE-2012-5607
https://notcve.org/view.php?id=CVE-2012-5607
The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack." La funcionalidad de reinicio "Contraseña olvidada" en ownCloud v4.0.9 y antes de v4.5.0 no comprueba correctamente el token de seguridad, lo que permite a atacantes remotos para cambiar la contraseña de las cuentas a través de vectores no especificados relacionados con un "Remote Timing Attack". • http://owncloud.org/changelog http://owncloud.org/security/advisories/oc-sa-2012-002 http://www.openwall.com/lists/oss-security/2012/11/30/3 https://github.com/owncloud/core/commit/99cd922 • CWE-255: Credentials Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 0CVE-2012-5609
https://notcve.org/view.php?id=CVE-2012-5609
Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file. Vulnerabilidad lista negra incompleta en lib/filesystem.php en ownCloud antes v4.5.2 permite a usuarios remotos autenticados ejecutar código PHP arbitrario mediante la carga de un archivo mount.php en un fichero ZIP • http://owncloud.org/changelog http://owncloud.org/security/advisories/oc-sa-2012-004 http://secunia.com/advisories/51357 http://www.openwall.com/lists/oss-security/2012/11/30/3 https://github.com/owncloud/core/commit/4619c66 https://github.com/owncloud/core/commit/e8a0cea •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 0CVE-2012-5610
https://notcve.org/view.php?id=CVE-2012-5610
Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name. Vulnerabilidad lista negra incompleta en lib/filesystem.php en ownCloud antes de v4.0.9 y v4.5.x antes de v4.5.2 permite a usuarios remotos autenticados ejecutar código PHP arbitrario mediante la carga de un archivo con un nombre especial manipulado. • http://owncloud.org/changelog http://owncloud.org/security/advisories/oc-sa-2012-005 http://secunia.com/advisories/51357 http://www.openwall.com/lists/oss-security/2012/11/30/3 https://github.com/owncloud/core/commit/3cd416b667 https://github.com/owncloud/core/commit/4b86c43 https://github.com/owncloud/core/commit/6540c0fc63 https://github.com/owncloud/core/commit/f599267 • CWE-20: Improper Input Validation •