OW
Product
ownCloud
On CISA KEVExploited in the wild
118
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 4Medium 30Low 2
Watch
Add ownCloud to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-9047 | – | Feb 4 | Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via unknown vectors Affected: through 5.0.17 |
| CVE-2014-9046 | – | Feb 4 | The OC_Util::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol Affected: through 5.0.17 |
| CVE-2014-9045 | – | Feb 4 | The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted… Affected: through 5.0.17 |
| CVE-2014-9043 | – | Feb 4 | The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via… Affected: through 5.0.17 |
| CVE-2014-9042 | – | Feb 4 | Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote… Affected: through 5.0.17 |
| CVE-2014-9041 | – | Feb 4 | The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote… Affected: through 5.0.17 |
| CVE-2014-5341 | – | Feb 4 | The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive… Affected: through 6.0.4 |
| CVE-2014-2044 | – | Oct 6 | Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions,… Affected: through 4.5.13 |
| CVE-2014-4929 | – | Aug 20 | Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local… Affected: through 5.0.16 |
| CVE-2013-0304 | – | Jun 5 | ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to… Affected: through 4.5.6 |
| CVE-2013-0302 | – | Jun 5 | Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK… Affected: through 4.0.11 |
| CVE-2014-3963 | – | Jun 4 | ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors Affected: through 6.0.0 |
| CVE-2014-3838 | – | Jun 4 | ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by… Affected: through 5.0.15 |
| CVE-2014-3837 | – | Jun 4 | The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared files via unspecified… Affected: through 6.0.2 |
| CVE-2014-3836 | – | Jun 4 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that (1)… Affected: through 6.0.2 |
| CVE-2014-3835 | – | Jun 4 | ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the files_external application, which allows remote authenticated users to add external storage… Affected: through 5.0.15 |
| CVE-2014-3834 | – | Jun 4 | ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2)… Affected: through 6.0.2 |
| CVE-2014-3833 | – | Jun 4 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to… Affected: through 5.0.15 |
| CVE-2013-1941 | – | Jun 4 | The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user… Affected: through 4.0.13 |
| CVE-2012-5336 | – | Jun 4 | lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related… Affected: through 4.0.7 |
| CVE-2012-5057 | – | Jun 4 | CRLF injection vulnerability in ownCloud Server before 4.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path… Affected: through 4.0.7 |
| CVE-2012-5056 | – | Jun 4 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) readyCallback… Affected: through 4.0.7 |
| CVE-2014-2057 | – | Mar 24 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 6.0.1 |
| CVE-2013-7344 | – | Mar 24 | Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors Affected: through 4.0.11 |
| CVE-2013-0303 | – | Mar 24 | Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via… Affected: through 4.0.11 |
| CVE-2013-0201 | – | Mar 18 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING… Affected: through 4.0.10 |
| CVE-2013-0301 | – | Mar 14 | Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users… Affected: through 4.0.11 |
| CVE-2013-0299 | – | Mar 14 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for… Affected: through 4.0.11 |
| CVE-2014-2049 | – | Mar 14 | The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors Affected: through 5.0.14 |
| CVE-2014-2047 | – | Mar 14 | Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions… Affected: through 6.0.1 |
| CVE-2013-2150 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML… Affected: through 4.5.11 |
| CVE-2013-2149 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via… Affected: before 4.0.16 |
| CVE-2013-2089 | – | Mar 14 | Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a… Affected: through 5.0.5 |
| CVE-2013-2085 | – | Mar 14 | Directory traversal vulnerability in apps/files_trashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a Affected: before 5.0.6 |
| CVE-2013-2048 | – | Mar 14 | ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors Affected: through 5.0.5 |
| CVE-2013-2047 | – | Mar 14 | The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate… Affected: through 5.0.5 |
| CVE-2013-2044 | – | Mar 14 | Open redirect vulnerability in the Login Page (index.php) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… Affected: through 5.0.5 |
| CVE-2013-2043 | – | Mar 14 | apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to… Affected: through 4.5.10 |
| CVE-2013-2042 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web… Affected: through 4.0.14 |
| CVE-2013-2040 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web… Affected: through 4.0.14 |
| CVE-2013-2039 | – | Mar 14 | Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files… Affected: through 4.0.14 |
| CVE-2013-1963 | – | Mar 14 | The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download… Affected: through 4.5.9 |
| CVE-2013-1851 | – | Mar 14 | Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated… Affected: through 4.0.12 |
| CVE-2013-1850 | – | Mar 14 | Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote… Affected: through 4.0.12 |
| CVE-2013-0307 | – | Mar 14 | Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via… Affected: through 4.0.11 |
| CVE-2013-0297 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or… Affected: through 4.0.11 |
| CVE-2013-1893 | – | Mar 9 | SQL injection vulnerability in addressbookprovider.php in ownCloud Server before 5.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors,… Affected: through 5.0.0 |
| CVE-2013-1890 | – | Mar 9 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) new_name parameter to… Affected: through 5.0.0 |
| CVE-2013-6403 | – | Dec 24 | The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB Affected: through 5.0.12 |
| CVE-2013-1942 | – | Aug 15 | Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before… Affected: through 5.0.3 |