Vulnerabilities > Owncloud > Owncloud > 4.5.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-01-03 | CVE-2012-5666 | Cross-Site Scripting vulnerability in Owncloud Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php. | 4.3 |
| 2013-01-03 | CVE-2012-5665 | Permissions, Privileges, and Access Controls vulnerability in Owncloud ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth and user_ldap by editing this file. | 4.3 |
| 2012-12-18 | CVE-2012-5610 | Improper Input Validation vulnerability in Owncloud Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name. | 6.5 |
| 2012-12-18 | CVE-2012-5609 | Unspecified vulnerability in Owncloud Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file. | 6.5 |
| 2012-12-18 | CVE-2012-5608 | Cross-Site Scripting vulnerability in Owncloud 4.5.0/4.5.1 Cross-site scripting (XSS) vulnerability in apps/user_webdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via arbitrary POST parameters. | 4.3 |
| 2012-12-18 | CVE-2012-5607 | Credentials Management vulnerability in Owncloud The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack." | 5.0 |
| 2012-12-18 | CVE-2012-5606 | Cross-Site Scripting vulnerability in Owncloud Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js. | 4.3 |