deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-2019
Published: 2014-06-02
Description: Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2013/04/28/3; http://www.openwall.com/lists/oss-security/2013/04/29/11; http://www.securityfocus.com/bid/59565
CVE: CVE-2013-2298
Published: 2014-06-02
Description: Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git%3Ba=commitdiff%3Bh=2fea03824925cbcb976f4191f4d8321e41a4d95b; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125125.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125128.html
CVE: CVE-2013-2710
Published: 2014-06-02
Description: Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/52960; http://wordpress.org/plugins/contextual-related-posts/changelog/; http://www.securityfocus.com/bid/59733
CVE: CVE-2013-3257
Published: 2014-06-02
Description: Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53122; http://wordpress.org/plugins/related-posts/changelog/; http://www.securityfocus.com/bid/59836
CVE: CVE-2013-3258
Published: 2014-06-02
Description: Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53120; http://wordpress.org/plugins/digg-digg/changelog/; http://www.securityfocus.com/bid/60046
CVE: CVE-2013-3476
Published: 2014-06-02
Description: Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to hijack the authentication of users for requests that change settings via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/53279; http://wordpress.org/plugins/wordpress-23-related-posts-plugin/changelog/; http://www.securityfocus.com/bid/59839
CVE: CVE-2013-4596
Published: 2014-06-02
Description: The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass access restrictions via a node listing.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/55255; http://www.securityfocus.com/bid/63568; https://drupal.org/node/2125239
CVE: CVE-2013-6433
Published: 2014-06-02
Description: The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration file.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0516.html; http://secunia.com/advisories/59533; http://www.ubuntu.com/usn/USN-2255-1
CVE: CVE-2013-6470
Published: 2014-06-02
Description: The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables authentication for Qpid, which allows remote attackers to gain access by connecting to Qpid.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2014-0517.html; https://bugzilla.redhat.com/show_bug.cgi?id=1051994; http://rhn.redhat.com/errata/RHSA-2014-0517.html
CVE: CVE-2013-7386
Published: 2014-06-02
Description: Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the gui_urls item in an account file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git%3Ba=commitdiff%3Bh=99258dcecba8ef36e1ce0fd6e0dacffe53613ac9; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125125.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125128.html
CVE: CVE-2013-7387
Published: 2014-06-02
Description: Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie.
CVSS Score: 6.8 (MEDIUM)
References: http://dle-news.ru/bags/v97/1549-patchi-bezopasnosti-dlya-versii-97.html; http://en.securitylab.ru/lab/PT-2012-53; http://secunia.com/advisories/51971
CVE: CVE-2014-0040
Published: 2014-06-02
Description: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2014-0579.html; https://bugs.launchpad.net/heat-templates/+bug/1267635; https://bugzilla.redhat.com/show_bug.cgi?id=1059514
CVE: CVE-2014-0041
Published: 2014-06-02
Description: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-0579.html; https://bugs.launchpad.net/heat-templates/+bug/1267635; https://bugzilla.redhat.com/show_bug.cgi?id=1059515
CVE: CVE-2014-0042
Published: 2014-06-02
Description: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2014-0579.html; https://bugs.launchpad.net/heat-templates/+bug/1267635; https://bugzilla.redhat.com/show_bug.cgi?id=1059520
CVE: CVE-2014-3937
Published: 2014-06-02
Description: SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://wordpress.org/plugins/contextual-related-posts/changelog/; http://wordpress.org/plugins/contextual-related-posts/changelog/
CVE: CVE-2014-2939
Published: 2014-06-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId parameter to share/page/task-edit.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/537684; http://www.kb.cert.org/vuls/id/537684
CVE: CVE-2014-2946
Published: 2014-06-02
Description: Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.858 allows remote attackers to hijack the authentication of administrators for requests that perform API operations and send SMS messages via a request element in an XML document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://b.fl7.de/2014/05/huawei-e303-sms-vulnerability-CVE-2014-2946.html; http://secunia.com/advisories/58992; http://www.kb.cert.org/vuls/id/325636
CVE: CVE-2014-2959
Published: 2014-06-02
Description: logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 (646G.GS002) allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/59019; http://www.kb.cert.org/vuls/id/124908; http://www.securityfocus.com/bid/67751
CVE: CVE-2014-3280
Published: 2014-06-03
Description: The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain potentially sensitive user information by visiting an unspecified Administration GUI web page, aka Bug IDs CSCun46045 and CSCun46116.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58400; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3280; http://tools.cisco.com/security/center/viewAlert.x?alertId=34379
CVE: CVE-2013-0191
Published: 2014-06-03
Description: libpam-pgsql (aka pam_pgsql) 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://seclists.org/oss-sec/2013/q1/86
CVE: CVE-2014-3466
Published: 2014-06-03
Description: Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://linux.oracle.com/errata/ELSA-2014-0594.html; http://linux.oracle.com/errata/ELSA-2014-0595.html; http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.html
CVE: CVE-2014-3941
Published: 2014-06-03
Description: TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html
CVE: CVE-2014-3942
Published: 2014-06-03
Description: The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/; http://www.debian.org/security/2014/dsa-2942
CVE: CVE-2014-3943
Published: 2014-06-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/; http://www.debian.org/security/2014/dsa-2942
CVE: CVE-2014-3944
Published: 2014-06-03
Description: The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/; http://www.debian.org/security/2014/dsa-2942; http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE: CVE-2014-3945
Published: 2014-06-03
Description: The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/; http://www.debian.org/security/2014/dsa-2942; http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE: CVE-2014-3946
Published: 2014-06-03
Description: The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/; http://www.debian.org/security/2014/dsa-2942; http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE: CVE-2014-3959
Published: 2014-06-03
Description: Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/58969; http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html; http://www.securityfocus.com/bid/67771
CVE: CVE-2014-2502
Published: 2014-06-04
Description: Cross-site scripting (XSS) vulnerability in rsa_fso.swf in EMC RSA Adaptive Authentication (Hosted) 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-06/0012.html; http://packetstormsecurity.com/files/126897/RSA-Adaptive-Authentication-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/67792
CVE: CVE-2014-0935
Published: 2014-06-04
Description: Unspecified vulnerability in IBM Smart Analytics System 7700 before FP 2.1.3.0 and 7710 before FP 2.1.3.0 allows local users to gain privileges via vectors related to events.
CVSS Score: 4.6 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21672887; https://exchange.xforce.ibmcloud.com/vulnerabilities/92298; http://www-01.ibm.com/support/docview.wss?uid=swg21672887
CVE: CVE-2014-3956
Published: 2014-06-04
Description: The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: ftp://ftp.sendmail.org/pub/sendmail/RELEASE_NOTES; http://advisories.mageia.org/MGASA-2014-0270.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134349.html
CVE: CVE-2012-5056
Published: 2014-06-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) readyCallback parameter to apps/files_odfviewer/src/webodf/webodf/flashput/PUT.swf, the (2) root parameter to apps/gallery/templates/index.php, or a (3) malformed query to lib/db.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/CVE-2012-5056/; http://owncloud.org/about/security/advisories/CVE-2012-5056/
CVE: CVE-2012-5057
Published: 2014-06-04
Description: CRLF injection vulnerability in ownCloud Server before 4.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the url path parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://owncloud.org/about/security/advisories/CVE-2012-5057/; http://owncloud.org/about/security/advisories/CVE-2012-5057/
CVE: CVE-2012-5336
Published: 2014-06-04
Description: lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://owncloud.org/about/security/advisories/CVE-2012-5336/; http://owncloud.org/about/security/advisories/CVE-2012-5336/
CVE: CVE-2013-0204
Published: 2014-06-04
Description: settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94
References: http://owncloud.org/about/security/advisories/oC-SA-2013-002/; http://owncloud.org/about/security/advisories/oC-SA-2013-002/
CVE: CVE-2013-1941
Published: 2014-06-04
Description: The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://owncloud.org/about/security/advisories/oC-SA-2013-015/; http://owncloud.org/about/security/advisories/oC-SA-2013-015/
CVE: CVE-2014-2053
Published: 2014-06-04
Description: getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
CVSS Score: 7.5 (HIGH)
References: http://getid3.sourceforge.net/source/changelog.txt; http://owncloud.org/about/security/advisories/oC-SA-2014-006/; http://secunia.com/advisories/58002
CVE: CVE-2014-2054
Published: 2014-06-04
Description: PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
CVSS Score: 7.5 (HIGH)
References: http://owncloud.org/about/security/advisories/oC-SA-2014-006/; https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt; http://owncloud.org/about/security/advisories/oC-SA-2014-006/
CVE: CVE-2014-2055
Published: 2014-06-04
Description: SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
CVSS Score: 7.5 (HIGH)
References: http://owncloud.org/about/security/advisories/oC-SA-2014-006/; https://github.com/fruux/sabre-dav/releases/tag/1.7.11; http://owncloud.org/about/security/advisories/oC-SA-2014-006/
CVE: CVE-2014-2056
Published: 2014-06-04
Description: PHPDocX, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
CVSS Score: 7.5 (HIGH)
References: http://owncloud.org/about/security/advisories/oC-SA-2014-006/; http://owncloud.org/about/security/advisories/oC-SA-2014-006/
CVE: CVE-2014-3786
Published: 2014-06-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in the contact module (admin/modules/contact.php) in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the (1) uemail or (2) subject parameter in the Contact form to contact/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126870/Pixie-CMS-1.04-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/67768; http://packetstormsecurity.com/files/126870/Pixie-CMS-1.04-Cross-Site-Scripting.html
CVE: CVE-2014-3832
Published: 2014-06-04
Description: Cross-site scripting (XSS) vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oc-sa-2014-010; http://owncloud.org/about/security/advisories/oc-sa-2014-010
CVE: CVE-2014-3833
Published: 2014-06-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oc-sa-2014-010; http://owncloud.org/about/security/advisories/oc-sa-2014-010
CVE: CVE-2014-3834
Published: 2014-06-04
Description: ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2) rename files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oc-sa-2014-011/; http://owncloud.org/about/security/advisories/oc-sa-2014-013/; http://owncloud.org/about/security/advisories/oc-sa-2014-011/
CVE: CVE-2014-3835
Published: 2014-06-04
Description: ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the files_external application, which allows remote authenticated users to add external storage via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oc-sa-2014-012/; http://owncloud.org/about/security/advisories/oc-sa-2014-012/
CVE: CVE-2014-3836
Published: 2014-06-04
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that (1) conduct cross-site scripting (XSS) attacks, (2) modify files, or (3) rename files via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://owncloud.org/about/security/advisories/oc-sa-2014-014/; http://owncloud.org/about/security/advisories/oc-sa-2014-014/
CVE: CVE-2014-3837
Published: 2014-06-04
Description: The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oc-sa-2014-015/; http://owncloud.org/about/security/advisories/oc-sa-2014-015/
CVE: CVE-2014-3838
Published: 2014-06-04
Description: ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/about/security/advisories/oc-sa-2014-016/; http://owncloud.org/about/security/advisories/oc-sa-2014-016/