CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9340
https://notcve.org/view.php?id=CVE-2017-9340
An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2. Un atacante ha iniciado sesión como un usuario normal y de alguna manera puede hacer que el administrador elimine las carpetas compartidas en ownCloud Server anterior a versión 10.0.2. • https://hackerone.com/reports/166581 https://owncloud.org/security/advisory/?id=oc-sa-2017-006 •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8896
https://notcve.org/view.php?id=CVE-2017-8896
ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters. OwnCloud Server anterior a versión 8.2.12, versión 9.0.x anterior a 9.0.10, versión 9.1.x anterior a 9.1.6 y versión 10.0.x anterior a 10.0.2, son vulnerables a un problema de tipo XSS en páginas de error mediante la inyección de código en los parámetros URL. • http://www.securityfocus.com/bid/99321 https://hackerone.com/reports/215410 https://owncloud.org/security/advisory/?id=oc-sa-2017-004 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2016-9462
https://notcve.org/view.php?id=CVE-2016-9462
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions. Nextcloud Server en versiones anteriores a 9.0.52 & ownCloud Server en versiones anteriores a 9.0.4 no están verificando correctamente los privilegios de restauración al restaurar un archivo. La capacidad de restauración de Nextcloud/ownCloud no estaba verificando si un usuario sólo tiene acceso de sólo lectura a un recurso compartido. • http://www.securityfocus.com/bid/97285 https://github.com/nextcloud/server/commit/1208953ba1d4d55a18a639846bbcdd66a2d5bc5e https://github.com/owncloud/core/commit/23383080731d092e079986464a8c4c9ffcb79f4c https://github.com/owncloud/core/commit/3b056fa68ce502ceb0db9b446dab3b9e7b10dd13 https://github.com/owncloud/core/commit/c93eca49c32428ece03dd67042772d5fa62c8d6e https://github.com/owncloud/core/commit/d31720b6f1e8c8dfeb5e8805ab35ad7c8000b2f1 https://hackerone.com/reports/146067 https://nextcloud.com/security/advisory/?id=nc-sa-2016-005 https:// • CWE-275: Permission Issues CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2016-9461
https://notcve.org/view.php?id=CVE-2016-9461
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files. Nextcloud Server en versiones anteriores a 9.0.52 & ownCloud Server en versiones anteriores a 9.0.4 no están verificando correctamente los permisos de comprobación de edición en las acciones de copia de WebDAV. • http://www.securityfocus.com/bid/97276 https://github.com/nextcloud/server/commit/3491400261c1454a9a30d3ec96969573330120cc https://github.com/owncloud/core/commit/0622e635d97cb17c5e1363e370bb8268cc3d2547 https://github.com/owncloud/core/commit/121a3304a0c37ccda0e1b63ddc528cba9121a36e https://github.com/owncloud/core/commit/acbbadb71ceee7f01da347f7dcd519beda78cc47 https://github.com/owncloud/core/commit/c0a4b7b3f38ad2eaf506484b3b92ec678cb021c9 https://hackerone.com/reports/145950 https://nextcloud.com/security/advisory/?id=nc-sa-2016-004 https:// • CWE-275: Permission Issues CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2016-9459
https://notcve.org/view.php?id=CVE-2016-9459
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed. • http://www.securityfocus.com/bid/97284 https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070 https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335 https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1 https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc https://hackerone.com/reports/146278 https://nextcloud.com/security/advisory/?id=nc-sa-2016-002 https://owncloud.org/security/advisory?id=oc-sa-2016-012 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-209: Generation of Error Message Containing Sensitive Information •