Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

owncloud owncloud 4.5.2 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2013-0204
settings/personal.php in ownCloud 4.5.x prior to 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.
Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.5Owncloud Owncloud 4.5.0Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.4
NA
CVE-2013-0304
ownCloud Server prior to 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulne...
Owncloud Owncloud 4.5.5Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.0Owncloud OwncloudOwncloud Owncloud 4.5.4
NA
CVE-2013-0300
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x prior to 4.5.7 allow remote malicious users to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (...
Owncloud Owncloud 4.5.0Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.4Owncloud Owncloud 4.5.5Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.6
NA
CVE-2013-0298
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x prior to 4.5.7 allow remote malicious users to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer....
Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.6Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.4Owncloud Owncloud 4.5.5Owncloud Owncloud 4.5.0
NA
CVE-2013-1822
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x prior to 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated user...
Owncloud Owncloud 4.5.0Owncloud Owncloud 4.5.7Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.4Owncloud Owncloud 4.5.5Owncloud Owncloud 4.5.6
NA
CVE-2012-5665
ownCloud 4.0.x prior to 4.0.10 and 4.5.x prior to 4.5.5 does not properly restrict access to settings.php, which allows remote malicious users to edit app configurations of user_webdavauth and user_ldap by editing this file.
Owncloud Owncloud 4.0.4Owncloud Owncloud 4.0.5Owncloud Owncloud 4.0.6Owncloud Owncloud 4.0.7Owncloud Owncloud 4.0.9Owncloud Owncloud 4.0.1Owncloud Owncloud 4.0.8Owncloud Owncloud 4.0.0Owncloud Owncloud 4.0.2Owncloud Owncloud 4.0.3Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.4Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.0
NA
CVE-2012-5666
Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x prior to 4.0.10 and 4.5.x prior to 4.5.5 allows remote malicious users to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php.
Owncloud Owncloud 4.0.8Owncloud Owncloud 4.0.0Owncloud Owncloud 4.0.9Owncloud Owncloud 4.0.1Owncloud Owncloud 4.0.5Owncloud Owncloud 4.0.3Owncloud Owncloud 4.0.6Owncloud Owncloud 4.0.7Owncloud Owncloud 4.0.4Owncloud Owncloud 4.0.2Owncloud Owncloud 4.5.4Owncloud Owncloud 4.5.0Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.3
NA
CVE-2013-1963
The contacts application in ownCloud prior to 4.5.10 and 5.x prior to 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download arbitrary contacts via unspecified vectors.
Owncloud Owncloud 5.0.0Owncloud Owncloud 5.0.1Owncloud Owncloud 5.0.2Owncloud Owncloud 5.0.3Owncloud Owncloud 5.0.4Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.4Owncloud OwncloudOwncloud Owncloud 4.5.5Owncloud Owncloud 4.5.6Owncloud Owncloud 4.5.7Owncloud Owncloud 4.5.8Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.0
NA
CVE-2013-2046
SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x prior to 4.5.11 and 5.x prior to 5.0.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Owncloud Owncloud 4.5.6Owncloud Owncloud 4.5.7Owncloud Owncloud 4.5.8Owncloud Owncloud 4.5.9Owncloud Owncloud 4.5.3Owncloud Owncloud 4.5.5Owncloud Owncloud 4.5.0Owncloud Owncloud 4.5.1Owncloud Owncloud 4.5.10Owncloud Owncloud 4.5.2Owncloud Owncloud 4.5.4Owncloud Owncloud 5.0.1Owncloud Owncloud 5.0.3Owncloud Owncloud 5.0.4Owncloud Owncloud 5.0.5Owncloud Owncloud 5.0.0Owncloud Owncloud 5.0.2
NA
CVE-2013-2043
apps/calendar/ajax/events.php in ownCloud prior to 4.5.11 and 5.x prior to 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendar_id parameter.
Owncloud Owncloud 4.5.0Owncloud Owncloud 5.0.0Owncloud Owncloud 4.5.8Owncloud Owncloud 4.5.9Owncloud Owncloud 5.0.2Owncloud Owncloud 5.0.4Owncloud Owncloud 4.5.5Owncloud Owncloud 4.5.7Owncloud Owncloud 4.5.1Owncloud OwncloudOwncloud Owncloud 4.5.2Owncloud Owncloud 4.5.3Owncloud Owncloud 5.0.1Owncloud Owncloud 5.0.3Owncloud Owncloud 5.0.5Owncloud Owncloud 4.5.4Owncloud Owncloud 4.5.6
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook