Skip to content
Noroxi

ownCloud records

169 published records for vendor owncloud.

Researcher profile

Entered KEV
2 · 1.2%
Weaponized
2 · 1.2%
Pre-auth RCE
5
With a fix record
11.8%
Median publish → KEV
510 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

169 records
  • CVE-2023-49103
    84Now

    An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

    HighCVSS 7.5KEVWeaponizedEPSS 78%

    owncloud · graph apiNov 21, 2023

  • CVE-2023-49105
    82Now

    An issue was discovered in ownCloud owncloud/core before 10.13.1.

    CriticalCVSS 9.8KEVWeaponizedEPSS 43%

    owncloud · owncloud serverNov 21, 2023

  • CVE-2015-4716
    47Plan

    Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows,

    CriticalCVSS 10.0No exploitEPSS 25%

    owncloud · owncloudOct 21, 2015

  • CVE-2014-2048
    40Plan

    The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementatio

    CriticalCVSS 9.8No exploitEPSS 3%

    owncloud · owncloudMar 26, 2018

  • CVE-2014-2052
    40Plan

    Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a de

    CriticalCVSS 9.8No exploitEPSS 2%

    owncloud · owncloudFeb 11, 2020

  • CVE-2021-35946
    39Monitor

    A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore ele

    CriticalCVSS 9.8No exploitEPSS 1%

    owncloud · owncloudSep 7, 2021

  • CVE-2015-7699
    37Monitor

    The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to inst

    CriticalCVSS 9.0No exploitEPSS 4%

    owncloud · owncloud serverOct 26, 2015

  • CVE-2015-4718
    37Monitor

    The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated user

    CriticalCVSS 9.0No exploitEPSS 3%

    owncloud · owncloudOct 21, 2015

  • CVE-2015-7698
    37Monitor

    icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argume

    CriticalCVSS 9.0No exploitEPSS 2%

    owncloud · smbOct 21, 2015

  • CVE-2020-28645
    36Monitor

    Deleting users with certain names caused system files to be deleted.

    CriticalCVSS 9.1No exploitEPSS 1%

    owncloud · owncloudFeb 9, 2021

  • CVE-2016-1499
    35Monitor

    ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information f

    HighCVSS 8.5No exploitEPSS 3%

    owncloud · owncloudJan 8, 2016

  • CVE-2021-33828
    35Monitor

    The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploade

    HighCVSS 8.8No exploitEPSS 1%

    owncloud · files antivirusJan 15, 2022

  • CVE-2014-2044
    34Monitor

    Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to

    HighCVSS 7.5Proof of conceptEPSS 12%

    owncloud · owncloudOct 6, 2014

  • CVE-2016-9463
    33Monitor

    Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass.

    HighCVSS 8.1No exploitEPSS 4%

    nextcloud · nextcloud serverMar 27, 2017

  • CVE-2020-10252
    33Monitor

    An issue was discovered in ownCloud before 10.4.

    HighCVSS 8.3No exploitEPSS 1%

    owncloud · owncloudFeb 19, 2021

  • CVE-2016-7102
    33Monitor

    ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special p

    HighCVSS 8.4No exploitEPSS 1%

    owncloud · owncloud desktop clientJan 23, 2017

  • CVE-2015-4717
    32Monitor

    The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_G

    HighCVSS 7.8No exploitEPSS 3%

    owncloud · owncloudOct 21, 2015

  • CVE-2021-44537
    32Monitor

    ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execut

    HighCVSS 7.8No exploitEPSS 3%

    owncloud · owncloud desktop clientJan 15, 2022

  • CVE-2014-2053
    31Monitor

    getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cau

    HighCVSS 7.5No exploitEPSS 5%

    getid3 · getid3Jun 4, 2014

  • CVE-2012-4392
    31Monitor

    index.php in ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass authentication via a cra

    HighCVSS 7.5No exploitEPSS 3%

    owncloud · owncloud serverSep 5, 2012

  • CVE-2015-6500
    31Monitor

    Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory

    HighCVSS 7.5No exploitEPSS 3%

    owncloud · owncloud serverOct 26, 2015

  • CVE-2014-2056
    31Monitor

    PHPDocX, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of

    HighCVSS 7.5No exploitEPSS 2%

    owncloud · owncloud serverJun 4, 2014

  • CVE-2014-2055
    31Monitor

    SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, ca

    HighCVSS 7.5No exploitEPSS 2%

    owncloud · owncloud serverJun 4, 2014

  • CVE-2020-28646
    31Monitor

    ownCloud owncloud/client before 2.7 allows DLL Injection.

    HighCVSS 7.8No exploitEPSS 1%

    owncloud · owncloud desktop clientFeb 26, 2021

  • CVE-2014-2054
    30Monitor

    PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml,

    HighCVSS 7.5No exploitEPSS 2%

    owncloud · owncloud serverJun 4, 2014