CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-2149
https://notcve.org/view.php?id=CVE-2013-2149
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files. Múltiples vulnerabilidades de XSS en ownCloud anterior a 4.0.16 y 5.x anterior a 5.0.7 permiten a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a través de vectores relacionados con archivos compartidos. • http://owncloud.org/about/security/advisories/oC-SA-2013-028 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 40EXPL: 0CVE-2013-2150
https://notcve.org/view.php?id=CVE-2013-2150
Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files. Múltiples vulnerabilidades de XSS en js/viewer.js en ownCloud anterior a 4.5.12 y 5.x anterior a 5.0.7 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores relacionados con archivos compartidos. • http://owncloud.org/about/security/advisories/oC-SA-2013-028 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 15EXPL: 1CVE-2012-5665
https://notcve.org/view.php?id=CVE-2012-5665
ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth and user_ldap by editing this file. ownCloud v4.0.x antes de v4.0.10 y v4.5.x antes de v4.5.5 no restringe el acceso a settings.php, lo que permite a atacantes remotos editar las configuraciones de aplicaciones de user_webdavauth y user_ldap modificando este archivo. • http://owncloud.org/changelog http://secunia.com/advisories/51614 http://www.openwall.com/lists/oss-security/2012/12/22/2 http://www.openwall.com/lists/oss-security/2012/12/22/5 http://www.securityfocus.com/bid/57030 https://exchange.xforce.ibmcloud.com/vulnerabilities/80808 https://github.com/owncloud/core/commit/c4ecbad https://github.com/owncloud/core/commit/db7ca53 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2012-5666
https://notcve.org/view.php?id=CVE-2012-5666
Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en bookmarks/js/bookmarks.js en ownCloud v4.0.x antes de v4.0.10 y v4.5.x antes de v4.5.5 permite a atacantse remotos inyectar secuencias de comandos web o HTML a través de PATH_INFO a apps/bookmark/index.php. • http://owncloud.org/changelog http://secunia.com/advisories/51614 http://www.openwall.com/lists/oss-security/2012/12/22/2 http://www.openwall.com/lists/oss-security/2012/12/22/5 http://www.securityfocus.com/bid/57030 https://github.com/owncloud/apps/commit/eafa9b2 https://github.com/owncloud/core/commit/b24c929cc0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2012-5606
https://notcve.org/view.php?id=CVE-2012-5606
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.9 y v4.5.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) nombre de archivo a apps/files_versions/js/versions.js (2) apps/files/js/filelist.js o (3) titulo del evento a 3rdparty/fullcalendar/js/fullcalendar.js. • http://owncloud.org/changelog http://owncloud.org/security/advisories/oc-sa-2012-001 http://secunia.com/advisories/51357 http://www.openwall.com/lists/oss-security/2012/11/30/3 https://github.com/owncloud/core/commit/ce66759 https://github.com/owncloud/core/commit/e45f36c https://github.com/owncloud/core/commit/e5f2d46 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •