full-disclosure

Open Source and information security mailing list archives

Message-ID: <-eoMrt8Ew-r-R1-1RFmIrm4VLZ8A-0iFJCOsXwYa3thoYAnHg90Q_Woa3NJjPJIpPbVAntXqcxOSdd-Kg75KvORAGOS7cITdNRFfaDUhXiI=@protonmail.com>
Date: Mon, 07 Nov 2016 05:13:41 -0500
From: Felix Matei <Felix.Matei@...tonmail.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Several unpatched vulns in OwnCloud

Dear Community

By comparing the advisory of NextCloud and OwnCloud I figured out that OwnCloud has multiple not patched vulnerabilities.

You can see list here it seems all patches missing from latest Nextcloud 10.0.1 release in OwnCloud: https://nextcloud.com/security/advisories. This seems to include XSS vulns and more.

An example exploit for one of the vulns would look like that: http://demo.owncloud.org/index.php/apps/gallery/#<script>alert(document.domain)</script>/%00

And also RhinosSecurity seem to have blogged about unfixed vulns in OwnCloud: https://rhinosecuritylabs.com/2016/10/operation-ownedcloud-exploitation-post-exploitation-persistence/

Hope that OwnCloud fixes this soon!

Cheers
Matei Felix

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives