📦

owncloud_server

Vendor: owncloud

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 4 Code Available
Total RCEs 7 Remote Access
Total CVEs 271 Total Indexed
Avg. EPSS 1.91% Exploit Prob.
Latest CVE CVE-2023-49105 Nov 21

Security Vulnerability Index

Page 4 / 28
7.5 CVSS
CVE-2014-2044
RCE Exploit Found

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter, as demonstrated using .htaccess::$DATA to upload a PHP program.

EPSS: 12.20%
6.8 CVSS
CVE-2014-4929

Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php.

EPSS: 0.59%
7.5 CVSS
CVE-2014-2051
RCE

ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."

EPSS: 0.62%
4.0 CVSS
CVE-2013-0304

ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.

EPSS: 0.28%
5.0 CVSS
CVE-2013-0302

Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK.

EPSS: 0.40%
4.0 CVSS
CVE-2014-3838

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts.

EPSS: 0.22%
4.0 CVSS
CVE-2014-3837

The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared files via unspecified vectors.

EPSS: 0.24%
6.8 CVSS
CVE-2014-3836

Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that (1) conduct cross-site scripting (XSS) attacks, (2) modify files, or (3) rename files via unspecified vectors.

EPSS: 0.16%
5.5 CVSS
CVE-2014-3835

ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the files_external application, which allows remote authenticated users to add external storage via unspecified vectors.

EPSS: 0.40%
7.5 CVSS
CVE-2014-3834

ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2) rename files via unspecified vectors.

EPSS: 0.41%