CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2016-9459
https://notcve.org/view.php?id=CVE-2016-9459
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed. • http://www.securityfocus.com/bid/97284 https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070 https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335 https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1 https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc https://hackerone.com/reports/146278 https://nextcloud.com/security/advisory/?id=nc-sa-2016-002 https://owncloud.org/security/advisory?id=oc-sa-2016-012 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2016-9460
https://notcve.org/view.php?id=CVE-2016-9460
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user. Nextcloud Server en versiones anteriores a 9.0.52 & ownCloud Server en versiones anteriores a 9.0.4 son vulnerables a un ataque de contenido falsificado en la aplicación de archivos. La barra de ubicación en la aplicación de archivos no estaba verificando los parámetros pasados. • http://www.securityfocus.com/bid/97282 https://github.com/nextcloud/server/commit/2da43e3751576bbc838f238a09955c4dcdebee8e https://github.com/nextcloud/server/commit/8aa0832bd449c44ec300da4189bd8ed4e036140c https://github.com/nextcloud/server/commit/dea8e29289a1b99d5e889627c2e377887f4f2983 https://github.com/owncloud/core/commit/c92c234059f8b1dc7d53122985ec0d398895a2cf https://hackerone.com/reports/145463 https://nextcloud.com/security/advisory/?id=nc-sa-2016-003 https://owncloud.org/security/advisory/?id=oc-sa-2016-013 • CWE-284: Improper Access Control CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 2CVE-2016-9463
https://notcve.org/view.php?id=CVE-2016-9463
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymous auth configured. This is the default on SMB servers nowadays and allows an unauthenticated attacker to gain access to an account without valid credentials. • https://github.com/nextcloud/apps/commit/b85ace6840b8a6704641086bc3b8eb8e81cb2274 https://github.com/nextcloud/apps/commit/decb91fd31f4ffab191cbf09ce4e5c55c67a4087 https://github.com/owncloud/apps/commit/16cbccfc946c8711721fa684d78135ca1fb64791 https://github.com/owncloud/apps/commit/5d47e7b52646cf79edadd78ce10c754290cbb732 https://github.com/owncloud/apps/commit/a0e07b7ddd5a5fd850a6e07f8457d05b76a300b3 https://hackerone.com/reports/148151 https://nextcloud.com/security/advisory/?id=nc-sa-2016-006 https://owncloud.org/security/advisory/?id=oc-sa- • CWE-287: Improper Authentication CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 0CVE-2017-5866
https://notcve.org/view.php?id=CVE-2017-5866
The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors. La característica de autocompletar en el cuadro de diálogo del E-Mail en ownCloud Server en versiones anteriores a 8.1.11, 8.2.x en versiones anteriores a 8.2.9, 9.0.x en versiones anteriores a 9.0.7 y 9.1.x en versiones anteriores a 9.1.3 permite a usuarios remotos autenticados obtener información sensible a través de vectores no especificados. • http://www.securityfocus.com/bid/96426 https://owncloud.org/security/advisory/?id=oc-sa-2017-002 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 0CVE-2017-5867
https://notcve.org/view.php?id=CVE-2017-5867
ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file. ownCloud Server en versiones anteriores a 8.1.11, 8.2.x en versiones anteriores a 8.2.9, 9.0.x en versiones anteriores a 9.0.7 y 9.1.x en versiones anteriores a 9.1.3 permite a usuarios remotos autenticados provocar una denegación de servicio (cuelgue del servidor e inundación de archivos de registro) a través de un archivo BMP de un bit • http://www.securityfocus.com/bid/96430 https://owncloud.org/security/advisory/?id=oc-sa-2017-003 • CWE-400: Uncontrolled Resource Consumption •