OW
Product
ownCloud
On CISA KEVExploited in the wild
118
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 4Medium 30Low 2
Watch
Add ownCloud to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-49105 In wildKEV | 9.8 | Nov 21 | ownCloud Improper Authentication Vulnerability Affected: All versions, or not specified |
| CVE-2019-25337 | 9.8 | Feb 12 | OwnCloud 8.1.8 - Username Disclosure Affected: 8.1.8 |
| CVE-2021-35946 | 9.8 | Sep 7 | A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions Affected: before 10.8.0 |
| CVE-2014-2052 | 9.8 | Feb 11 | Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other… Affected: before 5.0.15 |
| CVE-2014-2048 | 9.8 | Mar 26 | The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation Affected: before 5.0.15 |
| CVE-2020-28645 | 9.1 | Feb 9 | Deleting users with certain names caused system files to be deleted Affected: before 10.6.0 |
| CVE-2016-1499 | 8.5 | Jan 8 | ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly… Affected: through 8.0.9; 8.2.0; 8.2.1 |
| CVE-2020-10252 | 8.3 | Feb 19 | An issue was discovered in ownCloud before 10.4 Affected: before 10.4.0 |
| CVE-2016-9463 | 8.1 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass Affected: 8.2.0 before 8.2.9; 9.0.0 before 9.0.4; 9.1.0 before 9.1.2 |
| CVE-2022-31649 | 7.5 | Jun 9 | ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer Affected: before 10.10.0 |
| CVE-2014-2050 | 6.5 | Jan 23 | Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests… Affected: before 5.0.15 |
| CVE-2017-9340 | 6.5 | Jul 17 | An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2 Affected: before 10.0.2 |
| CVE-2017-5867 | 6.5 | Mar 3 | ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and… Affected: through 8.1.10; 8.2.0; 8.2.1; 8.2.2; 8.2.3; 8.2.4; +14 more |
| CVE-2020-16255 | 6.1 | Jan 15 | ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' Affected: before 10.5 |
| CVE-2017-8896 | 6.1 | Jul 17 | ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters Affected: through 8.2.11; 9.0.0 through 9.0.9; after 9.1.0 through 9.1.5; 10.0.0 before 10.0.2 |
| CVE-2016-9466 | 6.1 | Mar 28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-9459 | 6.1 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS Affected: before 9.0.4 |
| CVE-2016-1498 | 6.1 | Jan 8 | Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2… Affected: through 7.0.11; 8.2.0; 8.2.1 |
| CVE-2020-10254 | 5.9 | Feb 19 | An issue was discovered in ownCloud before 10.4 Affected: before 10.4.0 |
| CVE-2016-5876 | 5.9 | Jan 23 | ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request Affected: through 8.2.5; 9.0.0; 9.0.1; 9.0.2 |
| CVE-2021-35948 | 5.4 | Sep 7 | Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client… Affected: before 10.8.0 |
| CVE-2013-0203 | 5.4 | Nov 22 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified… Affected: through 4.0.10 |
| CVE-2014-1665 | 5.4 | Mar 20 | Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file Affected: before 6.0.1 |
| CVE-2017-9338 | 5.4 | Jul 17 | Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 Affected: before 8.2.12; 9.0.0 before 9.0.10; 9.1.0 before 9.1.6; 10.0.0 before 10.0.2 |
| CVE-2016-9465 | 5.4 | Mar 28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-7419 | 5.4 | Sep 17 | Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated… Affected: through 9.0.3 |
| CVE-2022-43679 | 5.3 | Nov 10 | The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless Affected: through 10.11.0 |
| CVE-2021-35949 | 5.3 | Sep 7 | The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share Affected: before 10.8.0 |
| CVE-2021-35947 | 5.3 | Sep 7 | The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid… Affected: before 10.8.0 |
| CVE-2017-9339 | 5.3 | Jul 17 | A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars Affected: before 10.0.2 |
| CVE-2016-9468 | 5.3 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-9467 | 5.3 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-9460 | 5.3 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app Affected: through 9.0.3 |
| CVE-2015-4715 | 4.9 | Feb 17 | The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been… Affected: before 6.0.8 |
| CVE-2020-36251 | 4.3 | Feb 19 | ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share Affected: before 10.3.0 |
| CVE-2020-28644 | 4.3 | Feb 9 | The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints Affected: before 10.6.0 |
| CVE-2016-9462 | 4.3 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file Affected: before 9.0.4 |
| CVE-2016-9461 | 4.3 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions Affected: before 9.0.4 |
| CVE-2017-5866 | 4.3 | Mar 3 | The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated… Affected: through 8.1.10; 8.2.0; 8.2.1; 8.2.2; 8.2.3; 8.2.4; +14 more |
| CVE-2016-1501 | 4.3 | Jan 8 | ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path… Affected: through 8.0.8 |
| CVE-2017-5865 | 3.7 | Mar 3 | The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on… Affected: through 8.1.10; 8.2.2; 8.2.3; 8.2.4; 8.2.5; 8.2.6; +12 more |
| CVE-2016-1500 | 3.1 | Jan 8 | ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return… Affected: through 7.0.11; 8.2.0; 8.2.1 |
| CVE-2015-7698 | – | Oct 21 | icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in… Affected: through 8.1.1 |
| CVE-2015-5954 | – | Oct 21 | The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote… Affected: through 6.0.8 |
| CVE-2015-4718 | – | Oct 21 | The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via… Affected: through 6.0.7 |
| CVE-2015-4717 | – | Oct 21 | The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array,… Affected: through 6.0.7 |
| CVE-2015-4716 | – | Oct 21 | Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attackers to reinstall… Affected: through 7.0.5 |
| CVE-2015-5953 | – | Oct 21 | Cross-site scripting (XSS) vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary… Affected: through 7.0.4 |
| CVE-2015-3011 | – | May 8 | Multiple cross-site scripting (XSS) vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow… Affected: through 5.0.18; through 6.0.6; through 7.0.4 |
| CVE-2014-9048 | – | Feb 4 | The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API Affected: through 5.0.17 |