OW
Product
ownCloud
On CISA KEVExploited in the wild
118
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 4Medium 30Low 2
Watch
Add ownCloud to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-2050 | 6.5 | Jan 23 | Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests… Affected: before 5.0.15 |
| CVE-2017-9340 | 6.5 | Jul 17 | An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2 Affected: before 10.0.2 |
| CVE-2017-5867 | 6.5 | Mar 3 | ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and… Affected: through 8.1.10; 8.2.0; 8.2.1; 8.2.2; 8.2.3; 8.2.4; +14 more |
| CVE-2020-16255 | 6.1 | Jan 15 | ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' Affected: before 10.5 |
| CVE-2017-8896 | 6.1 | Jul 17 | ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters Affected: through 8.2.11; 9.0.0 through 9.0.9; after 9.1.0 through 9.1.5; 10.0.0 before 10.0.2 |
| CVE-2016-9466 | 6.1 | Mar 28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-9459 | 6.1 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS Affected: before 9.0.4 |
| CVE-2016-1498 | 6.1 | Jan 8 | Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2… Affected: through 7.0.11; 8.2.0; 8.2.1 |
| CVE-2020-10254 | 5.9 | Feb 19 | An issue was discovered in ownCloud before 10.4 Affected: before 10.4.0 |
| CVE-2016-5876 | 5.9 | Jan 23 | ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request Affected: through 8.2.5; 9.0.0; 9.0.1; 9.0.2 |
| CVE-2021-35948 | 5.4 | Sep 7 | Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client… Affected: before 10.8.0 |
| CVE-2013-0203 | 5.4 | Nov 22 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified… Affected: through 4.0.10 |
| CVE-2014-1665 | 5.4 | Mar 20 | Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file Affected: before 6.0.1 |
| CVE-2017-9338 | 5.4 | Jul 17 | Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 Affected: before 8.2.12; 9.0.0 before 9.0.10; 9.1.0 before 9.1.6; 10.0.0 before 10.0.2 |
| CVE-2016-9465 | 5.4 | Mar 28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-7419 | 5.4 | Sep 17 | Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated… Affected: through 9.0.3 |
| CVE-2022-43679 | 5.3 | Nov 10 | The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless Affected: through 10.11.0 |
| CVE-2021-35949 | 5.3 | Sep 7 | The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share Affected: before 10.8.0 |
| CVE-2021-35947 | 5.3 | Sep 7 | The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid… Affected: before 10.8.0 |
| CVE-2017-9339 | 5.3 | Jul 17 | A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars Affected: before 10.0.2 |
| CVE-2016-9468 | 5.3 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-9467 | 5.3 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app Affected: 9.0.0 before 9.0.6; 9.1.0 before 9.1.2 |
| CVE-2016-9460 | 5.3 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app Affected: through 9.0.3 |
| CVE-2015-4715 | 4.9 | Feb 17 | The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been… Affected: before 6.0.8 |
| CVE-2020-36251 | 4.3 | Feb 19 | ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share Affected: before 10.3.0 |
| CVE-2020-28644 | 4.3 | Feb 9 | The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints Affected: before 10.6.0 |
| CVE-2016-9462 | 4.3 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file Affected: before 9.0.4 |
| CVE-2016-9461 | 4.3 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions Affected: before 9.0.4 |
| CVE-2017-5866 | 4.3 | Mar 3 | The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated… Affected: through 8.1.10; 8.2.0; 8.2.1; 8.2.2; 8.2.3; 8.2.4; +14 more |
| CVE-2016-1501 | 4.3 | Jan 8 | ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path… Affected: through 8.0.8 |
Showing 30