HexBrain
Sign in

Browse / ownCloud

ownCloud

94disclosed reports
$4,350paid in bounties

See its reports on the map

What gets reported to ownCloud

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Possible to steal any protected files on AndroidInformation Disclosure · medium
    $750115 votes
  2. Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) · high
    111 votes
  3. Authentication Bypass with usage of PreSignedURLImproper Access Control - Generic · high
    $2,00044 votes
  4. Federated share permissions can be increased by recipientImproper Access Control - Generic · medium
    $50029 votes
  5. Banner Grabbing - Apache Server Version DisclousureInformation Disclosure
    19 votes
  6. Arbitrary Code Injection in ownCloud’s Windows ClientCommand Injection - Generic
    16 votes
  7. GitHub Security Lab (GHSL) Vulnerability Report: Insufficient path validation in ReceiveExternalFilesActivity.java (GHSL-2022-060)Path Traversal · low
    $5014 votes
  8. Remote Code Execution through "Files_antivirus" pluginCode Injection · medium
    14 votes
  9. GitHub Security Lab (GHSL) Vulnerability Report: SQLInjection in FileContentProvider.kt (GHSL-2022-059)SQL Injection · medium
    $30012 votes
  10. Theft of protected files on AndroidViolation of Secure Design Principles · low
    $5011 votes
  11. Protocol Smuggling over LDAP password fieldCRLF Injection · low
    11 votes
  12. User Information Disclosure via REST APIInformation Disclosure · low
    11 votes
  13. SMB User Authentication Bypass and PersistenceImproper Authentication - Generic
    11 votes
  14. RCE in ci.owncloud.com / ci.owncloud.orgCode Injection
    10 votes
  15. Password Complexity Not Enforced On Password ChangeViolation of Secure Design Principles · low
    9 votes
  16. apps.owncloud.com: Malicious file upload leads to remote code executionCode Injection
    9 votes
  17. Remote Code Execution on ownCloud instances with ImageMagick installedCode Injection · critical
    7 votes
  18. [api.owncloud.org] CRLF InjectionCRLF Injection
    7 votes
  19. HTML Injection in OwncloudResource Injection · medium
    $1506 votes
  20. Outdated Jenkins server hosted at OwnCloud.orgInformation Disclosure
    6 votes
  21. Accessable HtaccessInformation Disclosure
    6 votes
  22. HTML injection in Desktop ClientCross-site Scripting (XSS) - Generic · low
    5 votes
  23. [doc.owncloud.org] CRLF InjectionCRLF Injection
    5 votes
  24. ownCloud 2.2.2.6192 DLL Hijacking VulnerabilityCode Injection
    $505 votes
  25. Open Redirector via (apps/files_pdfviewer) for un-authenticated users.Open Redirect
    $1505 votes
  26. Webview Vulnerablity [OwnCloudAndroid Application] Cross-site Scripting (XSS) - Generic
    5 votes
  27. apps.owncloud.com: XSS via referrerCross-site Scripting (XSS) - Generic
    5 votes
  28. Cross site scripting in apps.owncloud.comCross-site Scripting (XSS) - Generic
    4 votes
  29. Exploiting unauthenticated encryption modeCryptographic Issues - Generic
    $3504 votes
  30. apps.owncloud.com: SSL Server Allows Anonymous Authentication Vulnerability (SMTP)Memory Corruption - Generic
    4 votes
  31. doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)Uncontrolled Resource Consumption · high
    3 votes
  32. bug reporting template encourages users to paste config file with passwordsInformation Disclosure · low
    3 votes
  33. Reflected XSS in owncloud.comCross-site Scripting (XSS) - Generic
    3 votes
  34. owncloud.com: Parameter pollution in social sharing buttonsViolation of Secure Design Principles
    3 votes
  35. apps.owncloud.com: Referer protection BypassedImproper Authentication - Generic
    3 votes
  36. Self-XSS in mails sent by [email protected]Violation of Secure Design Principles
    3 votes
  37. Apache Range Header Denial of Service Attack (Confirmed PoC)Uncontrolled Resource Consumption
    3 votes
  38. apps.owncloud.com: Potential XSSCross-site Scripting (XSS) - Generic
    3 votes
  39. apps.owncloud.com: Edit Question didn't check ACLsPrivilege Escalation
    3 votes
  40. Lack of HSTS on https://apps.owncloud.comCryptographic Issues - Generic
    3 votes
  41. CSRF in apps.owncloud.comCross-Site Request Forgery (CSRF)
    3 votes
  42. apps.owncloud.com: Stored XSS in profile pageCross-site Scripting (XSS) - Generic
    3 votes
  43. apps.owncloud.com: SSL Session cookie without secure flag setImproper Authentication - Generic
    3 votes
  44. apps.owncloud.com: Session Cookie in URL can be captured by hackersImproper Authentication - Generic
    3 votes
  45. owncloud.com: Content Sniffing not disabledViolation of Secure Design Principles
    3 votes
  46. [forum.owncloud.org] IE, Edge XSS via Request-URICross-site Scripting (XSS) - Generic
    2 votes
  47. XXE at host vpn.owncloud.comCommand Injection - Generic
    2 votes
  48. owncloud.com: WP Super Cache plugin is outdatedCross-site Scripting (XSS) - Generic
    2 votes
  49. [s3.owncloud.com] Web Server HTTP Trace/Track Method Support Violation of Secure Design Principles
    2 votes
  50. gallery_plus: Content Spoofing Violation of Secure Design Principles
    2 votes
  51. Full Path Disclosure Information Disclosure
    2 votes
  52. ConfigViolation of Secure Design Principles
    2 votes
  53. owncloud.com: Outdated plugins contains public exploits Violation of Secure Design Principles
    2 votes
  54. owncloud.com: Account Compromise Through CSRFCross-Site Request Forgery (CSRF)
    2 votes
  55. demo.owncloud.org: HTTP compression is enabled potentially leading to BREACH attackCryptographic Issues - Generic
    2 votes
  56. test1.owncloud.com: Web Server HTTP Trace/Track Method Support Cross-Site Tracing VulnerabilityImproper Authentication - Generic
    2 votes
  57. demo.owncloud.org: Web Server HTTP Trace/Track Method Support Cross-Site Tracing VulnerabilityCross-site Scripting (XSS) - Generic
    2 votes
  58. apps.owncloud.com: Path DisclosureInformation Disclosure
    2 votes
  59. owncloud.com: Cross Site TracingCross-site Scripting (XSS) - Generic
    2 votes
  60. owncloud.com: DOM Based XSSCross-site Scripting (XSS) - Generic
    2 votes
  61. doc.owncloud.com: PHP info page disclosure Information Disclosure
    1 votes
  62. doc.owncloud.org: X-XSS-Protection not enabledCross-site Scripting (XSS) - Generic
    1 votes
  63. doc.owncloud.org has missing PHP handlerInformation Disclosure
    1 votes
  64. DROWN AttackCryptographic Issues - Generic
    1 votes
  65. owncloud.com: Persistent XSS In Account ProfileCross-site Scripting (XSS) - Generic
    1 votes
  66. No Any Kind of Protection on Delete accountImproper Authentication - Generic
    1 votes
  67. Information Exposure Through Directory ListingInformation Disclosure
    1 votes
  68. Apache documentationInformation Disclosure
    1 votes
  69. owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)Uncontrolled Resource Consumption
    1 votes
  70. Full Path Disclosure Information Disclosure
    1 votes
  71. apps.owncloud.com: CSRF change privacy settingsCross-Site Request Forgery (CSRF)
    1 votes
  72. apps.owncloud.com: Mixed Active Scripting Issue Information Disclosure
    1 votes
  73. daily.owncloud.com: Information disclosurePrivilege Escalation
    1 votes
  74. *.owncloud.com / *.owncloud.org: Using not strong enough SSL ciphersViolation of Secure Design Principles
    1 votes
  75. s2.owncloud.com: SSL Session cookie without secure flag setInformation Disclosure
    1 votes
  76. s2.owncloud.com: Web Server HTTP Trace/Track Method Support Cross-Site Tracing VulnerabilityCross-site Scripting (XSS) - Generic
    1 votes
  77. owncloud.com: PermError SPF Permanent Error: Too many DNS lookupsViolation of Secure Design Principles
    1 votes
  78. apps.owncloud.com: Multiple reflected XSS by insecure URL generation (IE only)Cross-site Scripting (XSS) - Generic
    1 votes
  79. owncloud.com: Allowed an attacker to force a user to change profile details. (XCSRF)Cross-Site Request Forgery (CSRF)
    1 votes
  80. owncloud.help: Text InjectionViolation of Secure Design Principles
  81. The csrf token remains same after user logs inViolation of Secure Design Principles
  82. Mixed Active Scripting Issue on stats.owncloud.orgViolation of Secure Design Principles
  83. otrs.owncloud.com: Reflected Cross-Site ScriptingCross-site Scripting (XSS) - Generic
  84. [https://test1.owncloud.com/owncloud6/] Guessable password used for admin userImproper Authentication - Generic
  85. directory listing in https://demo.owncloud.org/doc/Information Disclosure