Page 8 of 160 results (0.005 seconds)

CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1

CVE-2016-9465

https://notcve.org/view.php?id=CVE-2016-9465

Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack. Nextcloud Server en versiones anteriores a 10.0.1 y ownCloud Server en versiones anteriores a 9.0.6 y 9.1.2 sufren de XSS almacenado en la exportación de imágenes CardDAV. La funcionalidad de exportación de imágenes CardDAV implementada en Nextcloud/ownCloud permite descargar imágenes almacenadas dentro de una vCard. • https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0 https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58e https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845 https://hackerone.com/reports/163338 https://nextcloud.com/security/advisory/?id=nc-sa-2016-008 https://owncloud.org/security/advisory/?id=oc-sa-2016-018 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1

CVE-2016-9462

https://notcve.org/view.php?id=CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions. Nextcloud Server en versiones anteriores a 9.0.52 & ownCloud Server en versiones anteriores a 9.0.4 no están verificando correctamente los privilegios de restauración al restaurar un archivo. La capacidad de restauración de Nextcloud/ownCloud no estaba verificando si un usuario sólo tiene acceso de sólo lectura a un recurso compartido. • http://www.securityfocus.com/bid/97285 https://github.com/nextcloud/server/commit/1208953ba1d4d55a18a639846bbcdd66a2d5bc5e https://github.com/owncloud/core/commit/23383080731d092e079986464a8c4c9ffcb79f4c https://github.com/owncloud/core/commit/3b056fa68ce502ceb0db9b446dab3b9e7b10dd13 https://github.com/owncloud/core/commit/c93eca49c32428ece03dd67042772d5fa62c8d6e https://github.com/owncloud/core/commit/d31720b6f1e8c8dfeb5e8805ab35ad7c8000b2f1 https://hackerone.com/reports/146067 https://nextcloud.com/security/advisory/?id=nc-sa-2016-005 https:// • CWE-275: Permission Issues CWE-284: Improper Access Control •

CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 1

CVE-2016-9468

https://notcve.org/view.php?id=CVE-2016-9468

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information. Nextcloud Server en versiones anteriores a 9.0.54 and 10.0.1 y ownCloud Server en versiones anteriores a 9.0.6 y 9.1.2 sufren de contenido de suplantación en la aplicación dav. El mensaje de excepción que se muestra en los puntos finales DAV contenía una entrada parcialmente controlable por el usuario que conducía a una posible representación errónea de la información. • https://github.com/nextcloud/server/commit/7350e13113c8ed484727a5c25331ec11d4d59f5f https://github.com/nextcloud/server/commit/a4cfb3ddc1f4cdb585e05c0e9b2f8e52a0e2ee3e https://github.com/owncloud/core/commit/96b8afe48570bc70088ccd8f897e9d71997d336e https://github.com/owncloud/core/commit/bcc6c39ad8c22a00323a114e9c1a0a834983fb35 https://hackerone.com/reports/149798 https://nextcloud.com/security/advisory/?id=nc-sa-2016-011 https://owncloud.org/security/advisory/?id=oc-sa-2016-021 • CWE-284: Improper Access Control CWE-451: User Interface (UI) Misrepresentation of Critical Information •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1

CVE-2016-9460

https://notcve.org/view.php?id=CVE-2016-9460

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user. Nextcloud Server en versiones anteriores a 9.0.52 & ownCloud Server en versiones anteriores a 9.0.4 son vulnerables a un ataque de contenido falsificado en la aplicación de archivos. La barra de ubicación en la aplicación de archivos no estaba verificando los parámetros pasados. • http://www.securityfocus.com/bid/97282 https://github.com/nextcloud/server/commit/2da43e3751576bbc838f238a09955c4dcdebee8e https://github.com/nextcloud/server/commit/8aa0832bd449c44ec300da4189bd8ed4e036140c https://github.com/nextcloud/server/commit/dea8e29289a1b99d5e889627c2e377887f4f2983 https://github.com/owncloud/core/commit/c92c234059f8b1dc7d53122985ec0d398895a2cf https://hackerone.com/reports/145463 https://nextcloud.com/security/advisory/?id=nc-sa-2016-003 https://owncloud.org/security/advisory/?id=oc-sa-2016-013 • CWE-284: Improper Access Control CWE-451: User Interface (UI) Misrepresentation of Critical Information •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2016-9466

https://notcve.org/view.php?id=CVE-2016-9466

Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability. Nextcloud Server en versiones anteriores a 10.0.1 y ownCloud Server en versiones anteriores a 9.0.6 y 9.1.2 sufren de Reflexed XSS en la aplicación Galería. La aplicación de la galería no estaba correctamente desinfectando los mensajes de excepción del servidor Nextcloud/ownCloud. • https://github.com/nextcloud/gallery/commit/f9ef505c1d60c9041e251682e0f6b3daad952d58 https://github.com/owncloud/gallery/commit/b3b3772fb9bec61ba10d357bef42b676fa474eee https://github.com/owncloud/gallery/commit/dc4887f1afcc0cf304f4a0694075c9364298ad8a https://hackerone.com/reports/165686 https://nextcloud.com/security/advisory/?id=nc-sa-2016-009 https://owncloud.org/security/advisory/?id=oc-sa-2016-019 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •