Page 6 of 106 results (0.011 seconds)

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2014-5341

https://notcve.org/view.php?id=CVE-2014-5341

04 Feb 2015 — The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network. El controlador del almacenaje externo de SFTP (files_external) en ownCloud Server anterior a 6.0.5 valida la clave del anfitrión RSA después del inicio de sesión, lo que permite a atacantes remotos obtener información sensible mediante la captura de trafico de la red. • https://owncloud.org/security/advisory/?id=oc-sa-2014-019 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 28EXPL: 0

CVE-2014-9041 – Mandriva Linux Security Advisory 2015-190

https://notcve.org/view.php?id=CVE-2014-9041

04 Feb 2015 — The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks. La funcionalidad de importación en la aplicación bookmarks application en el servidor ownCloud anterior a 5.0.18, 6.x anterior a 6.0.6, y 7.x anterior a 7.0.3 no valida los tokens CSRF, lo que permiten a atacantes remotos realizar ataques de CSRF. Multiple vulnerabilities have been discovered and co... • https://owncloud.org/security/advisory/?id=oc-sa-2014-027 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.8EPSS: 0%CPEs: 22EXPL: 0

CVE-2014-4929

https://notcve.org/view.php?id=CVE-2014-4929

20 Aug 2014 — Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php. Vulnerabilidad de salto de directorio en el componente de enrutamiento en ownCloud Server anterior a 5.0.17 y 6.0.x anterior a 6.0.4 permite a atacantes remotos incluir y ejecutar ficheros locales arbitrarios a través de un .. (punto punto) en un nombre de fichero, relaci... • http://advisories.mageia.org/MGASA-2014-0301.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 8.0EPSS: 0%CPEs: 7EXPL: 0

CVE-2013-0304

https://notcve.org/view.php?id=CVE-2013-0304

05 Jun 2014 — ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is. ownCloud Server anterior a 4.5.7 no comprueba debidamente la propiedad de calendarios, lo que permite a usuarios remotos autenticados leer archivos calendar... • http://owncloud.org/about/security/advisories/oC-SA-2013-007 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0

CVE-2014-2051

https://notcve.org/view.php?id=CVE-2014-2051

05 Jun 2014 — ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query." ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2 permite a atacantes remotos realizar un ataque de inyección LDAP a través de vectores no especificados, tal y como fue demostrado utilizando una 'consulta de inicio de sesión.' • http://owncloud.org/about/security/advisories/oC-SA-2014-005 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2014-3834

https://notcve.org/view.php?id=CVE-2014-3834

04 Jun 2014 — ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2) rename files via unspecified vectors. ownCloud Server anterior a 6.0.3 no comprueba debidamente permisos, lo que permite a usuarios remotos autenticados (1) acceder a los contactos de otros usuarios a través del libro de direcciones o (2) renombrar archivos a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oc-sa-2014-011 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 0

CVE-2014-3835

https://notcve.org/view.php?id=CVE-2014-3835

04 Jun 2014 — ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the files_external application, which allows remote authenticated users to add external storage via unspecified vectors. ownCloud Server anterior a 5.0.16 y 6.0.x anterior a 6.0.3 no comprueba permisos a la aplicación files_external, lo que permite a usuarios remotos autenticados añadir almacenaje externo a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oc-sa-2014-012 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.1EPSS: 0%CPEs: 20EXPL: 0

CVE-2014-2054 – Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)

https://notcve.org/view.php?id=CVE-2014-2054

04 Jun 2014 — PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. PHPExcel anterior a 1.8.0, utilizado en ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2, no deshabilita la carga de entidades externas en libxml, lo que permite a atacantes remotos leer archivos arbitrarios, ... • http://owncloud.org/about/security/advisories/oC-SA-2014-006 • CWE-1395: Dependency on Vulnerable Third-Party Component •

CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2014-3963

https://notcve.org/view.php?id=CVE-2014-3963

04 Jun 2014 — ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors. ownCloud Server anterior a 6.0.1 no comprueba debidamente permisos, lo que permite a usuarios remotos autenticados acceder a vistas preliminares de imágenes a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2014-009 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 0%CPEs: 80EXPL: 0

CVE-2014-2055

https://notcve.org/view.php?id=CVE-2014-2055

04 Jun 2014 — SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. SabreDAV anterior a 1.7.11, utilizado en ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2, permite a atacantes remotos leer archivos arbitrarios, causar una denegación de servicio o posiblemente tener otro impacto a través de un ataque de entidad externa XML (XXE). • http://owncloud.org/about/security/advisories/oC-SA-2014-006 •