HexBrain
Sign in

Browse / ownCloud

ownCloud

94disclosed reports
$4,350paid in bounties

See its reports on the map

What gets reported to ownCloud

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Possible to steal any protected files on AndroidInformation Disclosure · medium
    $750115 votes
  2. Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) · high
    111 votes
  3. Authentication Bypass with usage of PreSignedURLImproper Access Control - Generic · high
    $2,00044 votes
  4. Federated share permissions can be increased by recipientImproper Access Control - Generic · medium
    $50029 votes
  5. Banner Grabbing - Apache Server Version DisclousureInformation Disclosure
    19 votes
  6. Remote Code Execution through Deserialization Attack in OwnBackup app.InformativeDeserialization of Untrusted Data · critical
    16 votes
  7. Arbitrary Code Injection in ownCloud’s Windows ClientCommand Injection - Generic
    16 votes
  8. GitHub Security Lab (GHSL) Vulnerability Report: Insufficient path validation in ReceiveExternalFilesActivity.java (GHSL-2022-060)Path Traversal · low
    $5014 votes
  9. Remote Code Execution through "Files_antivirus" pluginCode Injection · medium
    14 votes
  10. GitHub Security Lab (GHSL) Vulnerability Report: SQLInjection in FileContentProvider.kt (GHSL-2022-059)SQL Injection · medium
    $30012 votes
  11. Theft of protected files on AndroidViolation of Secure Design Principles · low
    $5011 votes
  12. Protocol Smuggling over LDAP password fieldCRLF Injection · low
    11 votes
  13. User Information Disclosure via REST APIInformation Disclosure · low
    11 votes
  14. SMB User Authentication Bypass and PersistenceImproper Authentication - Generic
    11 votes
  15. RCE in ci.owncloud.com / ci.owncloud.orgCode Injection
    10 votes
  16. Password Complexity Not Enforced On Password ChangeViolation of Secure Design Principles · low
    9 votes
  17. apps.owncloud.com: Malicious file upload leads to remote code executionCode Injection
    9 votes
  18. Remote Code Execution on ownCloud instances with ImageMagick installedCode Injection · critical
    7 votes
  19. [api.owncloud.org] CRLF InjectionCRLF Injection
    7 votes
  20. HTML Injection in OwncloudResource Injection · medium
    $1506 votes
  21. Outdated Jenkins server hosted at OwnCloud.orgInformation Disclosure
    6 votes
  22. Accessable HtaccessInformation Disclosure
    6 votes
  23. HTML injection in Desktop ClientCross-site Scripting (XSS) - Generic · low
    5 votes
  24. Stored xssDuplicateCross-site Scripting (XSS) - Generic
    5 votes
  25. [doc.owncloud.org] CRLF InjectionCRLF Injection
    5 votes
  26. ownCloud 2.2.2.6192 DLL Hijacking VulnerabilityCode Injection
    $505 votes
  27. Open Redirector via (apps/files_pdfviewer) for un-authenticated users.Open Redirect
    $1505 votes
  28. No email verification during registrationInformativeImproper Authentication - Generic
    5 votes
  29. Webview Vulnerablity [OwnCloudAndroid Application] Cross-site Scripting (XSS) - Generic
    5 votes
  30. apps.owncloud.com: XSS via referrerCross-site Scripting (XSS) - Generic
    5 votes
  31. password reset email spammingN/AImproper Access Control - Generic · low
    4 votes
  32. Cross site scripting in apps.owncloud.comCross-site Scripting (XSS) - Generic
    4 votes
  33. Exploiting unauthenticated encryption modeCryptographic Issues - Generic
    $3504 votes
  34. apps.owncloud.com: SSL Server Allows Anonymous Authentication Vulnerability (SMTP)Memory Corruption - Generic
    4 votes
  35. doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)Uncontrolled Resource Consumption · high
    3 votes
  36. bug reporting template encourages users to paste config file with passwordsInformation Disclosure · low
    3 votes
  37. doc.owncloud.org: XSS via ReferrerInformativeCross-site Scripting (XSS) - Generic
    3 votes
  38. Reflected XSS in owncloud.comCross-site Scripting (XSS) - Generic
    3 votes
  39. owncloud.com: Parameter pollution in social sharing buttonsViolation of Secure Design Principles
    3 votes
  40. apps.owncloud.com: Referer protection BypassedImproper Authentication - Generic
    3 votes
  41. Self-XSS in mails sent by [email protected]Violation of Secure Design Principles
    3 votes
  42. Apache Range Header Denial of Service Attack (Confirmed PoC)Uncontrolled Resource Consumption
    3 votes
  43. apps.owncloud.com: Potential XSSCross-site Scripting (XSS) - Generic
    3 votes
  44. Password appears in user name fieldInformativeViolation of Secure Design Principles
    3 votes
  45. apps.owncloud.com: Edit Question didn't check ACLsPrivilege Escalation
    3 votes
  46. Lack of HSTS on https://apps.owncloud.comCryptographic Issues - Generic
    3 votes
  47. CSRF in apps.owncloud.comCross-Site Request Forgery (CSRF)
    3 votes
  48. apps.owncloud.com: Stored XSS in profile pageCross-site Scripting (XSS) - Generic
    3 votes
  49. apps.owncloud.com: SSL Session cookie without secure flag setImproper Authentication - Generic
    3 votes
  50. apps.owncloud.com: Session Cookie in URL can be captured by hackersImproper Authentication - Generic
    3 votes
  51. owncloud.com: Content Sniffing not disabledViolation of Secure Design Principles
    3 votes
  52. File System Monitoring Queue OverflowInformativeBusiness Logic Errors · low
    2 votes
  53. owncloud.com open redirectInformativeOpen Redirect
    2 votes
  54. [forum.owncloud.org] IE, Edge XSS via Request-URICross-site Scripting (XSS) - Generic
    2 votes
  55. XXE at host vpn.owncloud.comCommand Injection - Generic
    2 votes
  56. owncloud.com: WP Super Cache plugin is outdatedCross-site Scripting (XSS) - Generic
    2 votes
  57. [s3.owncloud.com] Web Server HTTP Trace/Track Method Support Violation of Secure Design Principles
    2 votes
  58. gallery_plus: Content Spoofing Violation of Secure Design Principles
    2 votes
  59. Full Path Disclosure Information Disclosure
    2 votes
  60. ConfigViolation of Secure Design Principles
    2 votes
  61. owncloud.com: Outdated plugins contains public exploits Violation of Secure Design Principles
    2 votes
  62. owncloud.com: Account Compromise Through CSRFCross-Site Request Forgery (CSRF)
    2 votes
  63. demo.owncloud.org: HTTP compression is enabled potentially leading to BREACH attackCryptographic Issues - Generic
    2 votes
  64. test1.owncloud.com: Web Server HTTP Trace/Track Method Support Cross-Site Tracing VulnerabilityImproper Authentication - Generic
    2 votes
  65. demo.owncloud.org: Web Server HTTP Trace/Track Method Support Cross-Site Tracing VulnerabilityCross-site Scripting (XSS) - Generic
    2 votes
  66. apps.owncloud.com: Path DisclosureInformation Disclosure
    2 votes
  67. owncloud.com: Cross Site TracingCross-site Scripting (XSS) - Generic
    2 votes
  68. owncloud.com: DOM Based XSSCross-site Scripting (XSS) - Generic
    2 votes
  69. This is not the security issue.Informative
    1 votes
  70. doc.owncloud.com: PHP info page disclosure Information Disclosure
    1 votes
  71. doc.owncloud.org: X-XSS-Protection not enabledCross-site Scripting (XSS) - Generic
    1 votes
  72. doc.owncloud.org has missing PHP handlerInformation Disclosure
    1 votes
  73. DROWN AttackCryptographic Issues - Generic
    1 votes
  74. owncloud.com: Persistent XSS In Account ProfileCross-site Scripting (XSS) - Generic
    1 votes
  75. No Any Kind of Protection on Delete accountImproper Authentication - Generic
    1 votes
  76. Information Exposure Through Directory ListingInformation Disclosure
    1 votes
  77. Apache documentationInformation Disclosure
    1 votes
  78. owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)Uncontrolled Resource Consumption
    1 votes
  79. Full Path Disclosure Information Disclosure
    1 votes
  80. apps.owncloud.com: CSRF change privacy settingsCross-Site Request Forgery (CSRF)
    1 votes
  81. apps.owncloud.com: Mixed Active Scripting Issue Information Disclosure
    1 votes
  82. daily.owncloud.com: Information disclosurePrivilege Escalation
    1 votes
  83. *.owncloud.com / *.owncloud.org: Using not strong enough SSL ciphersViolation of Secure Design Principles
    1 votes
  84. s2.owncloud.com: SSL Session cookie without secure flag setInformation Disclosure
    1 votes
  85. s2.owncloud.com: Web Server HTTP Trace/Track Method Support Cross-Site Tracing VulnerabilityCross-site Scripting (XSS) - Generic
    1 votes
  86. owncloud.com: PermError SPF Permanent Error: Too many DNS lookupsViolation of Secure Design Principles
    1 votes
  87. apps.owncloud.com: Multiple reflected XSS by insecure URL generation (IE only)Cross-site Scripting (XSS) - Generic
    1 votes
  88. owncloud.com: Allowed an attacker to force a user to change profile details. (XCSRF)Cross-Site Request Forgery (CSRF)
    1 votes
  89. owncloud.help: Text InjectionViolation of Secure Design Principles
  90. The csrf token remains same after user logs inViolation of Secure Design Principles
  91. Mixed Active Scripting Issue on stats.owncloud.orgViolation of Secure Design Principles
  92. otrs.owncloud.com: Reflected Cross-Site ScriptingCross-site Scripting (XSS) - Generic
  93. [https://test1.owncloud.com/owncloud6/] Guessable password used for admin userImproper Authentication - Generic
  94. directory listing in https://demo.owncloud.org/doc/Information Disclosure