Owncloud: >> Owncloud Server >> 6.0.1 Security Vulnerabilities
The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared files via unspecified vectors.
CVSS Score
4.0
EPSS Score
0.002
Published
2014-06-04
ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts.
CVSS Score
4.0
EPSS Score
0.001
Published
2014-06-04
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
CVSS Score
7.5
EPSS Score
0.027
Published
2014-06-04
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
CVSS Score
7.5
EPSS Score
0.005
Published
2014-06-04
ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration.
CVSS Score
4.9
EPSS Score
0.002
Published
2014-03-24
The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors.
CVSS Score
5.0
EPSS Score
0.003
Published
2014-03-14
Page 3