Page 8 of 104 results (0.003 seconds)

CVSS: 8.8EPSS: 0%CPEs: 22EXPL: 0

CVE-2013-7344

https://notcve.org/view.php?id=CVE-2013-7344

23 Mar 2014 — Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this issue was SPLIT from CVE-2013-0303 due to different affected versions. Vulnerabilidad no especificada en core/settings.php en ownCloud anterior a 4.0.12 y 4.5.x anterior a 4.5.6 permite a usuarios remotos autenticados ejecutar código PHP arbitrario a través de vectores desconocidos. NOTA: este problema fue separado de ... • http://owncloud.org/about/security/advisories/oC-SA-2013-006 •

CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 2

CVE-2013-0201

https://notcve.org/view.php?id=CVE-2013-0201

18 Mar 2014 — Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php. Múltiples vulnerabilidades de XSS en ownCloud 4.5.5, 4.0.10 y versiones anteriores permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de l... • http://osvdb.org/89505 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 23EXPL: 0

CVE-2013-0299

https://notcve.org/view.php?id=CVE-2013-0299

14 Mar 2014 — Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to app... • http://owncloud.org/about/security/advisories/oC-SA-2013-004 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0

CVE-2013-1939

https://notcve.org/view.php?id=CVE-2013-1939

14 Mar 2014 — The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character. El plugin HTML\Browser en SabreDAV anterior a 1.6.9, 1.7.x anterior a 1.7.7 y 1.8.x anterior a 1.8.5, utilizado en ownCloud, cuando se ejecuta en Windows, no comprueba debidamente los separadores de rutas en la ruta base, lo que ... • http://owncloud.org/about/security/advisories/oC-SA-2013-016 • CWE-20: Improper Input Validation •

CVSS: 6.5EPSS: 0%CPEs: 31EXPL: 0

CVE-2013-2039

https://notcve.org/view.php?id=CVE-2013-2039

14 Mar 2014 — Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en lib/files/view.php en ownCloud anterior a 4.0.15, 4.5.x 4.5.11 y 5.x anterior a 5.0.6 permite a usuarios remotos autenticados acceder a archivos arbitrarios a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2013-020 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 5.4EPSS: 0%CPEs: 31EXPL: 0

CVE-2013-2040

https://notcve.org/view.php?id=CVE-2013-2040

14 Mar 2014 — Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en ownCloud anterior a 4.0.15, 4.5.x anterior a 4.5.11 y 5.0.x anterior a 5.0.6 permiten a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2013-021 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2014-2047

https://notcve.org/view.php?id=CVE-2014-2047

14 Mar 2014 — Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de fijación de sesión en ownCloud anterior a 6.0.2, cuando PHP está configurado para aceptar parámetros de sesión mediante una solicitud GET, permite a atacantes remotos secuestrar sesiones web a través de vectores no especificados. • http://owncloud.org/about/security/advisories/oC-SA-2014-001 • CWE-287: Improper Authentication •

CVSS: 8.1EPSS: 0%CPEs: 25EXPL: 0

CVE-2013-1851

https://notcve.org/view.php?id=CVE-2013-1851

14 Mar 2014 — Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors. Vulnerabilidad de lista negra incompleta en lib/migrate.php en ownCloud anterior a 4.0.13 y 4.5.x anterior a 4.5.8, cuando la aplicación user-migrate está habilitada, permite a usuarios remotos autenticados importar archivos arbitrarios a la cuenta del us... • http://owncloud.org/about/security/advisories/oC-SA-2013-010 •

CVSS: 9.8EPSS: 0%CPEs: 17EXPL: 0

CVE-2013-2043

https://notcve.org/view.php?id=CVE-2013-2043

14 Mar 2014 — apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendar_id parameter. apps/calendar/ajax/events.php en ownCloud anterior a 4.5.11 y 5.x anterior a 5.0.6 no comprueba debidamente la propiedad de un calendario, lo que permite a usuarios remotos autenticados descargar calendarios arbitrarios a través del parámetro calendar_id. • http://owncloud.org/about/security/advisories/oC-SA-2013-024 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0

CVE-2013-2047

https://notcve.org/view.php?id=CVE-2013-2047

14 Mar 2014 — The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password. La página de inicio de sesión (también conocido como index.php) en ownCloud anterior a 5.0.6 no deshabilita la configuración de autocompletar para el parámetro password, lo que facilita a atacantes físicamente próximos adivinar la contraseña. • http://owncloud.org/about/security/advisories/oC-SA-2013-023 • CWE-264: Permissions, Privileges, and Access Controls •