Vincent Petry

20 exploits Active since Mar 2017
CVE-2016-9461 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Authenticated Arbitrary File Write via WebDAV COPY
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.
CVSS 4.3
CVE-2016-9462 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Unauthenticated File Restore Privilege Bypass
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.
CVSS 4.3
CVE-2016-9459 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 and ownCloud Server < 9.0.4 - Stored Cross-Site Scripting via Download Log
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.
CVSS 6.1
CVE-2016-9461 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Authenticated Arbitrary File Write via WebDAV COPY
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.
CVSS 4.3
CVE-2016-9462 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Unauthenticated File Restore Privilege Bypass
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.
CVSS 4.3
CVE-2016-9459 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 and ownCloud Server < 9.0.4 - Stored Cross-Site Scripting via Download Log
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.
CVSS 6.1
CVE-2016-9461 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Authenticated Arbitrary File Write via WebDAV COPY
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.
CVSS 4.3
CVE-2016-9462 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Unauthenticated File Restore Privilege Bypass
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.
CVSS 4.3
CVE-2016-9465 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 10.0.1 & ownCloud Server < 9.0.6 and 9.1.2 - Stored Cross-Site Scripting in CardDAV Image Export
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.
CVSS 5.4
CVE-2016-9466 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 10.0.1 and ownCloud Server < 9.0.6 and 9.1.2 - Reflected Cross-Site Scripting in Gallery Application
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.
CVSS 6.1
CVE-2016-9467 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.54 and 10.0.1 & ownCloud Server < 9.0.6 and 9.1.2 - Content Spoofing in Files App Location Bar
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
CVSS 5.3
CVE-2016-9468 WRITEUP MEDIUM WRITEUP
Nextcloud Server <9.0.54, 10.0.1 & ownCloud Server <9.0.6, 9.1.2 - Content Spoofing via DAV
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.
CVSS 5.3
CVE-2016-9459 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 and ownCloud Server < 9.0.4 - Stored Cross-Site Scripting via Download Log
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.
CVSS 6.1
CVE-2016-9460 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 and ownCloud Server < 9.0.4 - Content Spoofing in Files App Location Bar
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
CVSS 5.3
CVE-2016-9461 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Authenticated Arbitrary File Write via WebDAV COPY
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.
CVSS 4.3
CVE-2016-9462 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.52 & ownCloud Server < 9.0.4 - Unauthenticated File Restore Privilege Bypass
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.
CVSS 4.3
CVE-2016-9465 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 10.0.1 & ownCloud Server < 9.0.6 and 9.1.2 - Stored Cross-Site Scripting in CardDAV Image Export
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.
CVSS 5.4
CVE-2016-9466 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 10.0.1 and ownCloud Server < 9.0.6 and 9.1.2 - Reflected Cross-Site Scripting in Gallery Application
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.
CVSS 6.1
CVE-2016-9467 WRITEUP MEDIUM WRITEUP
Nextcloud Server < 9.0.54 and 10.0.1 & ownCloud Server < 9.0.6 and 9.1.2 - Content Spoofing in Files App Location Bar
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
CVSS 5.3
CVE-2016-9468 WRITEUP MEDIUM WRITEUP
Nextcloud Server <9.0.54, 10.0.1 & ownCloud Server <9.0.6, 9.1.2 - Content Spoofing via DAV
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.
CVSS 5.3