Login Request a demo
OW
Vendor
Owncloud
17 products with CVEs on record
255
CVEs
4
On KEV
0
New 30D
Products
OW
ownCloud
ownCloud
9.8
117 CVEs1 on KEV0 new
OS
Owncloud Server
Owncloud
9.8
108 CVEs1 on KEV0 new
GA
Graph Api
Owncloud
7.5
1 CVEs1 on KEV0 new
OG
ownCloud graphapi
ownCloud
7.5
1 CVEs1 on KEV0 new
OC
Owncloud Client
Owncloud
6.8
7 CVEs0 on KEV0 new
OD
Owncloud Desktop Client
Owncloud
8.4
5 CVEs0 on KEV0 new
O1
ownCloud 10
owncloud
9.1
4 CVEs0 on KEV0 new
FA
Files Antivirus
Owncloud
8.8
3 CVEs0 on KEV0 new
AF
Anti-Virus for ownCloud
owncloud
9.1
1 CVEs0 on KEV0 new
DF
DrawIO for ownCloud
owncloud
8.2
1 CVEs0 on KEV0 new
FF
File Firewall
Owncloud
7.5
1 CVEs0 on KEV0 new
GU
Guests
Owncloud
5.3
1 CVEs0 on KEV0 new
OA
Oauth2
Owncloud
6.1
1 CVEs0 on KEV0 new
OC
ownCloud Core
owncloud
9.1
1 CVEs0 on KEV0 new
SH
SharePoint
owncloud
8.5
1 CVEs0 on KEV0 new
SM
Smb
Owncloud
–
1 CVEs0 on KEV0 new
UL
User Ldap
Owncloud
2.7
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-53831
DF
DrawIO for ownCloud
owncloud
8.2
0%
Jul 6DrawIO for ownCloud 10 is vulnerable to Stored XSS
CVE-2025-53830
AF
Anti-Virus for ownCloud
owncloud
9.1
0%
Jul 6Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2025-53829
O1
ownCloud 10
owncloud
8.0
1%
Jul 6ownCloud 10 is vulnerable to Relative Path Traversal
CVE-2025-53828
O1
ownCloud 10
owncloud
8.5
0%
Jul 6SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2025-53827
OC
ownCloud Core
owncloud
9.1
1%
Jul 6ownCloud Core: Updater has an exposed dangerous method or function
CVE-2025-59716
GU
Guests
Owncloud
5.3
1%
Nov 5ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint
CVE-2023-49104
OA
Oauth2
Owncloud
6.1
1%
Nov 21An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled
CVE-2023-49105
In wildKEV
OS
Owncloud Server
Owncloud
9.8
43%
Nov 21ownCloud Improper Authentication Vulnerability
CVE-2023-49103
In wildKEV
GA
Graph Api
Owncloud
7.5
78%
Nov 21ownCloud graphapi Information Disclosure Vulnerability
CVE-2023-24804
OC
Owncloud Client
Owncloud
4.4
1%
Feb 13The ownCloud Android app allows ownCloud users to access, share, and edit files and folders
CVE-2023-23948
OC
Owncloud Client
Owncloud
5.5
0%
Feb 13The ownCloud Android app allows ownCloud users to access, share, and edit files and folders
CVE-2022-43679
OW
Owncloud
Owncloud
5.3
0%
Nov 10The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless
CVE-2022-31649
OW
Owncloud
Owncloud
7.5
1%
Jun 9ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer
CVE-2022-25339
OC
Owncloud Client
Owncloud
5.5
0%
Apr 7ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers
CVE-2022-25338
OC
Owncloud Client
Owncloud
6.8
0%
Apr 7ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers
CVE-2021-44537
OD
Owncloud Desktop Client
Owncloud
7.8
3%
Jan 15ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution
CVE-2021-33828
FA
Files Antivirus
Owncloud
8.8
1%
Jan 15The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share) are supposed to be…
CVE-2021-33827
FA
Files Antivirus
Owncloud
7.2
2%
Jan 15The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings
CVE-2021-40537
UL
User Ldap
Owncloud
2.7
1%
Sep 8Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app
CVE-2021-35948
OW
Owncloud
Owncloud
5.4
1%
Sep 7Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client…
CVE-2021-35946
OW
Owncloud
Owncloud
9.8
1%
Sep 7A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions
CVE-2021-35949
OW
Owncloud
Owncloud
5.3
1%
Sep 7The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share
CVE-2021-35947
OW
Owncloud
Owncloud
5.3
1%
Sep 7The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid…
CVE-2021-29659
OS
Owncloud Server
Owncloud
6.5
1%
May 20ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure
CVE-2020-28646
OD
Owncloud Desktop Client
Owncloud
7.8
1%
Feb 26ownCloud owncloud/client before 2.7 allows DLL Injection
CVE-2020-36248
OC
Owncloud Client
Owncloud
4.6
0%
Feb 19The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature…
CVE-2020-36252
OS
Owncloud Server
Owncloud
5.7
1%
Feb 19ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number
CVE-2020-36251
OW
Owncloud
Owncloud
4.3
1%
Feb 19ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share
CVE-2020-36250
OC
Owncloud Client
Owncloud
4.6
0%
Feb 19In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past
CVE-2020-36249
FF
File Firewall
Owncloud
7.5
1%
Feb 19The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares
CVE-2020-10254
OW
Owncloud
Owncloud
5.9
2%
Feb 19An issue was discovered in ownCloud before 10.4
CVE-2020-10252
OW
Owncloud
Owncloud
8.3
1%
Feb 19An issue was discovered in ownCloud before 10.4
CVE-2020-28645
OW
Owncloud
Owncloud
9.1
1%
Feb 9Deleting users with certain names caused system files to be deleted
CVE-2020-28644
OW
Owncloud
Owncloud
4.3
0%
Feb 9The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints
CVE-2020-16144
FA
Files Antivirus
Owncloud
5.7
1%
Feb 9When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user uploads a virus the…
CVE-2020-16255
OW
Owncloud
Owncloud
6.1
1%
Jan 15ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'
CVE-2015-4715
OS
Owncloud Server
Owncloud
4.9
1%
Feb 17The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been…
CVE-2014-2052
OW
Owncloud
Owncloud
9.8
2%
Feb 11Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other…
CVE-2014-2050
OW
Owncloud
Owncloud
6.5
1%
Jan 23Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests…
CVE-2013-0202
OS
Owncloud Server
Owncloud
6.1
1%
Dec 17Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to…
CVE-2013-0203
OS
Owncloud Server
Owncloud
5.4
1%
Nov 22Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified…
CVE-2014-2048
OW
Owncloud
Owncloud
9.8
3%
Mar 26The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation
CVE-2014-1665
OW
Owncloud
Owncloud
5.4
3%
Mar 20Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file
CVE-2017-9340
OW
Owncloud
Owncloud
6.5
1%
Jul 17An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2
CVE-2017-9339
OW
Owncloud
Owncloud
5.3
1%
Jul 17A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars
CVE-2017-9338
OW
Owncloud
Owncloud
5.4
1%
Jul 17Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2
CVE-2017-8896
OW
Owncloud
Owncloud
6.1
1%
Jul 17ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters
CVE-2016-9468
OW
Owncloud
Owncloud
5.3
2%
Mar 28Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app
CVE-2016-9467
OW
Owncloud
Owncloud
5.3
3%
Mar 28Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app
CVE-2016-9466
OW
Owncloud
Owncloud
6.1
2%
Mar 28Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application
CVE-2016-9465
OW
Owncloud
Owncloud
5.4
1%
Mar 28Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export
CVE-2016-9463
OW
Owncloud
Owncloud
8.1
4%
Mar 28Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass
CVE-2016-9462
OW
Owncloud
Owncloud
4.3
2%
Mar 28Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file
CVE-2016-9461
OW
Owncloud
Owncloud
4.3
2%
Mar 28Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions
CVE-2016-9460
OW
Owncloud
Owncloud
5.3
2%
Mar 28Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app
CVE-2016-9459
OW
Owncloud
Owncloud
6.1
1%
Mar 28Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS
CVE-2017-5867
OW
Owncloud
Owncloud
6.5
1%
Mar 3ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and…
CVE-2017-5866
OW
Owncloud
Owncloud
4.3
1%
Mar 3The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated…
CVE-2017-5865
OW
Owncloud
Owncloud
3.7
1%
Mar 3The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on…
CVE-2016-7102
OD
Owncloud Desktop Client
Owncloud
8.4
1%
Jan 23ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special path" in the C: drive