Vulnerabilities > Owncloud > Owncloud > 3.0.3
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2014-03-09 | CVE-2013-1890 | Cross-Site Scripting vulnerability in Owncloud Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) new_name parameter to apps/bookmarks/ajax/renameTag.php or (2) multiple unspecified parameters to unknown files in apps/contacts/ajax/. | 4.3 |
2013-12-24 | CVE-2013-6403 | Permissions, Privileges, and Access Controls vulnerability in Owncloud The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB. | 6.8 |
2013-08-15 | CVE-2013-1942 | Cross-Site Scripting vulnerability in multiple products Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023. | 4.3 |
2012-12-18 | CVE-2012-5610 | Improper Input Validation vulnerability in Owncloud Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name. | 6.5 |
2012-12-18 | CVE-2012-5609 | Unspecified vulnerability in Owncloud Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file. | 6.5 |
2012-12-18 | CVE-2012-5607 | Credentials Management vulnerability in Owncloud The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack." | 5.0 |
2012-12-18 | CVE-2012-5606 | Cross-Site Scripting vulnerability in Owncloud Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js. | 4.3 |
2012-09-05 | CVE-2012-4753 | Cross-Site Request Forgery (CSRF) vulnerability in Owncloud Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. | 6.8 |
2012-09-05 | CVE-2012-4752 | Permissions, Privileges, and Access Controls vulnerability in Owncloud appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors. | 5.0 |
2012-09-05 | CVE-2012-4397 | Cross-Site Scripting vulnerability in Owncloud Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3) unspecified vectors to apps/contacts/lib/vcard.php. | 4.3 |