Vulnerabilities > Owncloud
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-03-03 | CVE-2017-5867 | Resource Exhaustion vulnerability in Owncloud ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file. | 6.5 |
| 2017-03-03 | CVE-2017-5866 | Information Exposure vulnerability in Owncloud The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors. | 4.3 |
| 2017-03-03 | CVE-2017-5865 | Information Exposure vulnerability in Owncloud The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts. | 3.7 |
| 2017-01-23 | CVE-2016-7102 | Code Injection vulnerability in Owncloud Desktop Client ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special path" in the C: drive. | 8.4 |
| 2017-01-23 | CVE-2016-5876 | Permissions, Privileges, and Access Controls vulnerability in Owncloud ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request. | 5.9 |
| 2016-09-17 | CVE-2016-7419 | Cross-site Scripting vulnerability in multiple products Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name. | 5.4 |
| 2016-01-08 | CVE-2016-1501 | Information Exposure vulnerability in Owncloud ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages. | 4.3 |
| 2016-01-08 | CVE-2016-1500 | Information Exposure vulnerability in Owncloud ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belonging to a sharing user by leveraging an incoming share. | 3.1 |
| 2016-01-08 | CVE-2016-1499 | Resource Management Errors vulnerability in Owncloud ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php. | 8.5 |
| 2016-01-08 | CVE-2016-1498 | Cross-site Scripting vulnerability in Owncloud Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL. | 6.1 |