OW
Product
ownCloud
On CISA KEVExploited in the wild
118
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 4Medium 30Low 2
Watch
Add ownCloud to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-5610 | – | Dec 18 | Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by… Affected: through 4.0.8 |
| CVE-2012-5609 | – | Dec 18 | Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php… Affected: through 4.5.1 |
| CVE-2012-5607 | – | Dec 18 | The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password… Affected: through 4.0.8 |
| CVE-2012-5606 | – | Dec 18 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to… Affected: through 4.0.8 |
| CVE-2012-4753 | – | Sep 5 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors Affected: through 4.0.4 |
| CVE-2012-4752 | – | Sep 5 | appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors Affected: through 4.0.5 |
| CVE-2012-4397 | – | Sep 5 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to… Affected: through 4.0.0 |
| CVE-2012-4396 | – | Sep 5 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to… Affected: through 4.0.1 |
| CVE-2012-4395 | – | Sep 5 | Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter Affected: through 4.0.2 |
| CVE-2012-4394 | – | Sep 5 | Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file… Affected: through 4.0.4 |
| CVE-2012-4393 | – | Sep 5 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use… Affected: through 4.0.5 |
| CVE-2012-4391 | – | Sep 5 | Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for… Affected: through 4.0.6 |
| CVE-2012-4390 | – | Sep 5 | (1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via… Affected: through 4.0.6 |
| CVE-2012-4389 | – | Sep 5 | Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an… Affected: through 4.0.6 |
| CVE-2012-2398 | – | Apr 20 | Cross-site scripting (XSS) vulnerability in files/ajax/download.php in ownCloud before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via the files… Affected: through 3.0.2 |
| CVE-2012-2397 | – | Apr 20 | Cross-site request forgery (CSRF) vulnerability in ownCloud before 3.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert… Affected: through 3.0.2 |
| CVE-2012-2270 | – | Apr 20 | Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing… Affected: through 3.0.2 |
| CVE-2012-2269 | – | Apr 20 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary field to… Affected: through 3.0.2 |