Owncloud: Security Vulnerabilities
The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share) are supposed to be deleted upon detection.
CVSS Score
8.8
EPSS Score
0.005
Published
2022-01-15
The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings.
CVSS Score
7.2
EPSS Score
0.013
Published
2022-01-15
Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for exploitation.
CVSS Score
2.7
EPSS Score
0.003
Published
2021-09-08
A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.
CVSS Score
9.8
EPSS Score
0.003
Published
2021-09-07
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.
CVSS Score
5.4
EPSS Score
0.002
Published
2021-09-07
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL.
CVSS Score
5.3
EPSS Score
0.003
Published
2021-09-07
The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share.
CVSS Score
5.3
EPSS Score
0.002
Published
2021-09-07
ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could cause higher than average load on the instance.
CVSS Score
6.5
EPSS Score
0.003
Published
2021-05-20
ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain directories when they were present.
CVSS Score
7.8
EPSS Score
0.001
Published
2021-02-26
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.
CVSS Score
3.9
EPSS Score
0.0
Published
2021-02-19