OS
Product
Owncloud Server
On CISA KEVExploited in the wild
108
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 8Low 1
Watch
Add Owncloud Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-29659 | 6.5 | May 20 | ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure Affected: 10.7.0 |
| CVE-2014-2050 | 6.5 | Jan 23 | Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests… Affected: 6.0.0 before 6.0.2 |
| CVE-2013-0202 | 6.1 | Dec 17 | Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to… Affected: 4.0.0 before 4.0.11; 4.5.0 before 4.5.6 |
| CVE-2016-1498 | 6.1 | Jan 8 | Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2… Affected: 8.0.0; 8.0.2; 8.0.3; 8.0.4; 8.0.5; 8.0.6; +6 more |
| CVE-2020-36252 | 5.7 | Feb 19 | ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number Affected: 10.0.9 before 10.3.1 |
| CVE-2013-0203 | 5.4 | Nov 22 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified… Affected: 4.5.0 through 4.5.5 |
| CVE-2015-4715 | 4.9 | Feb 17 | The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been… Affected: 7.0.0 before 7.0.6; 8.0.0 before 8.0.4 |
| CVE-2016-1501 | 4.3 | Jan 8 | ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path… Affected: 8.1.0; 8.1.1; 8.1.3 |
Showing 8