[FD] Several unpatched vulns in OwnCloud

[Felix Matei <Felix.Matei@xxxxxxxxxxxxxx>]

Dear Community

By comparing the advisory of NextCloud and OwnCloud I figured out that OwnCloud 
has multiple not patched vulnerabilities.

You can see list here it seems all patches missing from latest Nextcloud 10.0.1 
release in OwnCloud: https://nextcloud.com/security/advisories. This seems to 
include XSS vulns and more.

An example exploit for one of the vulns would look like that: 
http://demo.owncloud.org/index.php/apps/gallery/#<script>alert(document.domain)</script>/%00

And also RhinosSecurity seem to have blogged about unfixed vulns in OwnCloud: 
https://rhinosecuritylabs.com/2016/10/operation-ownedcloud-exploitation-post-exploitation-persistence/;

Hope that OwnCloud fixes this soon!

Cheers
Matei Felix

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/