Latest owncloud owncloud Vulnerabilities

● CVE-2023-49105
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no ...
ownCloud ownCloud<10.13.1
● CVE-2023-49103
ownCloud graphapi Information Disclosure Vulnerability
ownCloud ownCloud=0.2.0
ownCloud ownCloud=0.3.0
ownCloud ownCloud
● CVE-2023-24804
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two byp...
Owncloud Owncloud<3.0
● CVE-2023-23948
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in `FileContentProvider.kt`. This...
Owncloud Owncloud<=3.0
● CVE-2022-43679
The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof the URL in password-reset e-mail messages.
ownCloud ownCloud<=10.11.0
● CVE-2022-31649
ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
ownCloud ownCloud<10.10.0
● CVE-2022-25339
ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers.
Owncloud Owncloud<2.20
● CVE-2022-25338
ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers.
Owncloud Owncloud<2.20
● CVE-2021-35948
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled co...
ownCloud ownCloud<10.8.0
● CVE-2021-35946
A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.
ownCloud ownCloud<10.8.0
● CVE-2021-35947
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...
ownCloud ownCloud<10.8.0
● CVE-2021-35949
The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share.
ownCloud ownCloud<10.8.0
● CVE-2021-29659
ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single reques...
ownCloud ownCloud=10.7.0
● CVE-2020-36248
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this...
Owncloud Owncloud<2.15
● CVE-2020-36252
ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number.
ownCloud ownCloud>=10.0.9<10.3.1
● CVE-2020-36251
ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share.
ownCloud ownCloud<10.3.0
● CVE-2020-10254
An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview.
ownCloud ownCloud<10.4.0
● CVE-2020-28645
Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data directory in the web root. This affects ownCl...
ownCloud ownCloud<10.6.0
● CVE-2020-28644
The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownCloud/core version < 10.6.
ownCloud ownCloud<10.6.0
● CVE-2020-16255
ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'
ownCloud ownCloud<10.5
● CVE-2015-4715
The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote ad...
ownCloud ownCloud<6.0.8
ownCloud ownCloud>=7.0.0<7.0.6
ownCloud ownCloud>=8.0.0<8.0.4
● CVE-2014-2052
Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML Ex...
ownCloud ownCloud<5.0.15
ownCloud ownCloud>=6.0.0<6.0.2
● CVE-2014-2050
Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords ...
ownCloud ownCloud<5.0.15
ownCloud ownCloud>=6.0.0<6.0.2
● CVE-2013-0202
Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.
ownCloud ownCloud>=4.0.0<4.0.11
ownCloud ownCloud>=4.5.0<4.5.6
● CVE-2013-0203
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified parameters to apps/cale...
ownCloud ownCloud<=4.0.10
ownCloud ownCloud>=4.5.0<=4.5.5

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203