CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2014-9049
https://notcve.org/view.php?id=CVE-2014-9049
04 Feb 2015 — The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method. La aplicación documents en ownCloud Server 6.x anterior a 6.0.6 y 7.x anterior a 7.0.3 permite a usuarios remotos autenticados obtener todos los identificadores de sesiones válidos a través de un método de la API no especificado. • https://owncloud.org/security/advisory/?id=oc-sa-2014-025 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 28EXPL: 0CVE-2014-9041 – Mandriva Linux Security Advisory 2015-190
https://notcve.org/view.php?id=CVE-2014-9041
04 Feb 2015 — The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks. La funcionalidad de importación en la aplicación bookmarks application en el servidor ownCloud anterior a 5.0.18, 6.x anterior a 6.0.6, y 7.x anterior a 7.0.3 no valida los tokens CSRF, lo que permiten a atacantes remotos realizar ataques de CSRF. Multiple vulnerabilities have been discovered and co... • https://owncloud.org/security/advisory/?id=oc-sa-2014-027 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 28EXPL: 0CVE-2014-9042 – Mandriva Linux Security Advisory 2015-190
https://notcve.org/view.php?id=CVE-2014-9042
04 Feb 2015 — Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this can be leveraged by remote attackers using CVE-2014-9041. Vulnerabilidad de XSS en la funcionalidad de importación en la aplicación bookmarks en ownCloud anterior a 5.0.18, 6.x anterior a 6.0.6, y 7.x anterior a 7.... • https://owncloud.org/security/advisory/?id=oc-sa-2014-028 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 28EXPL: 0CVE-2014-9043 – Mandriva Linux Security Advisory 2015-190
https://notcve.org/view.php?id=CVE-2014-9043
04 Feb 2015 — The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind. La aplicación user_ldap (también conocido como el backend del usuario y grupo de LDAP) en ownCloud anterior a 5.0.18, 6.x anterior a 6.0.6, y 7.x anterior a 7.0.3 permite a atacantes remotos evadir la autenticación a través de un byte nulo en... • https://owncloud.org/security/advisory/?id=oc-sa-2014-020 • CWE-287: Improper Authentication •
CVSS: 9.1EPSS: 0%CPEs: 25EXPL: 0CVE-2014-9045 – Mandriva Linux Security Advisory 2015-190
https://notcve.org/view.php?id=CVE-2014-9045
04 Feb 2015 — The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password. El backend de FTP en user_external en ownCloud Server anterior a 5.0.18 y 6.x anterior a 6.0.6 permite a atacantes remotos evadir los requisitos de la autenticación a través de una contraseña manipulada. Multiple vulnerabilities have been discovered and corrected in owncloud. The updated packages have been upgraded to the 5.0.19... • https://owncloud.org/security/advisory/?id=oc-sa-2014-022 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 22EXPL: 0CVE-2014-4929
https://notcve.org/view.php?id=CVE-2014-4929
20 Aug 2014 — Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php. Vulnerabilidad de salto de directorio en el componente de enrutamiento en ownCloud Server anterior a 5.0.17 y 6.0.x anterior a 6.0.4 permite a atacantes remotos incluir y ejecutar ficheros locales arbitrarios a través de un .. (punto punto) en un nombre de fichero, relaci... • http://advisories.mageia.org/MGASA-2014-0301.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2013-0302
https://notcve.org/view.php?id=CVE-2013-0302
05 Jun 2014 — Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK. Vulnerabilidad no especificada en ownCloud Server anterior a 4.0.12 permite a atacantes remotos obtener información sensible a través de vectores no especificados relacionados con 'inclusión del suite de prue... • http://owncloud.org/about/security/advisories/oC-SA-2013-005 •
CVSS: 8.0EPSS: 0%CPEs: 7EXPL: 0CVE-2013-0304
https://notcve.org/view.php?id=CVE-2013-0304
05 Jun 2014 — ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is. ownCloud Server anterior a 4.5.7 no comprueba debidamente la propiedad de calendarios, lo que permite a usuarios remotos autenticados leer archivos calendar... • http://owncloud.org/about/security/advisories/oC-SA-2013-007 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2014-2051
https://notcve.org/view.php?id=CVE-2014-2051
05 Jun 2014 — ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query." ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2 permite a atacantes remotos realizar un ataque de inyección LDAP a través de vectores no especificados, tal y como fue demostrado utilizando una 'consulta de inicio de sesión.' • http://owncloud.org/about/security/advisories/oC-SA-2014-005 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 0CVE-2014-3838
https://notcve.org/view.php?id=CVE-2014-3838
04 Jun 2014 — ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts. ownCloud Server anterior a 5.0.16 y 6.0.x anterior a 6.0.3 no comprueba debidamente permisos, lo que permite a usuarios remotos autenticados leer los nombres de archivos de otros usuarios mediante el aprovechamiento de acceso a múltiples cuentas. • http://owncloud.org/about/security/advisories/oc-sa-2014-016 • CWE-264: Permissions, Privileges, and Access Controls •