CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2012-4753
https://notcve.org/view.php?id=CVE-2012-4753
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en ownCloud anterior a v4.0.5, permite a atacantes remotos secuestrar la autenticación de víctimas no especificadas mediante vectores desconocidos(1) . • http://owncloud.org/changelog • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 8CVE-2012-4396
https://notcve.org/view.php?id=CVE-2012-4396
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) nombre de ficheros para apps/user_ldap/settings.php; (2) url o (3) parámetro título para apps/bookmarks/ajax/editBookmark.php; (4) etiqueta o (5) parámetro page para apps/bookmarks/ajax/updateList.php; (6) identity para apps/user_openid/settings.php; (7) nombre stack en apps/gallery/lib/tiles.php; (8) parámetro root para apps/gallery/templates/index.php; (9) calendar displayname en apps/calendar/templates/part.import.php; (10) calendar uri en apps/calendar/templates/part.choosecalendar.rowfields.php; (11) título, (12) localización, o (13) parámetro descripción en apps/calendar/lib/object.php; (14) ciertos vectores en core/js/multiselect.js; o (15) artist, (16) album, o (17) title comments parámetros en apps/media/lib_scanner.php. • http://www.openwall.com/lists/oss-security/2012/08/11/1 http://www.openwall.com/lists/oss-security/2012/09/02/2 https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027 https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5 https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7 https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438 https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c https://github.com/owncloud&#x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 1CVE-2012-4394
https://notcve.org/view.php?id=CVE-2012-4394
Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en apps/files/js/filelist.js en ownCloud anterior a v4.0.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro file • http://www.openwall.com/lists/oss-security/2012/08/11/1 http://www.openwall.com/lists/oss-security/2012/09/02/2 https://github.com/owncloud/core/commit/d203fa2c50f4b2791e68e2b8ab9a0f8b94f9c9f8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 1%CPEs: 11EXPL: 1CVE-2012-4389
https://notcve.org/view.php?id=CVE-2012-4389
Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file. Vulnerabilidad de incompatibilidad en lib/migrate.php en ownCloud anterior a v4.0.7 permite a atacantes remotos ejecutar código arbitrario mediante la carga de un archivo .htaccess en un archivo import.zip y el acceso a un archivo PHP cargado. • http://www.openwall.com/lists/oss-security/2012/09/02/2 https://github.com/owncloud/core/commit/4fd069b47906ebcf83887970c732d464dbe7d37a •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 1CVE-2012-4397
https://notcve.org/view.php?id=CVE-2012-4397
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3) unspecified vectors to apps/contacts/lib/vcard.php. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del displayname calendar para part.choosecalendar.rowfields.php o (2) part.choosecalendar.rowfields.shared.php en apps/calendar/templates/; o (3) vectores no especificados para apps/contacts/lib/vcard.php. • http://owncloud.org/changelog http://www.openwall.com/lists/oss-security/2012/08/11/1 http://www.openwall.com/lists/oss-security/2012/09/02/2 https://github.com/owncloud/core/commit/00595351400523168e18a08e3ffa5c3b1e7c1f6e https://github.com/owncloud/core/commit/54a371700554ed21a5cb7db03126b6c95ae4cbd3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •