CVE-2014-1665

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.noobroot.com/2014/02/owncloud-600a-when-xss-vulnerability.htmlExploit, Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/65457Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91012Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/125086Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/31427/Exploit, Third Party Advisory, VDB Entry
http://blog.noobroot.com/2014/02/owncloud-600a-when-xss-vulnerability.htmlExploit, Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/65457Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91012Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/125086Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/31427/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 20, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-16668.3The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prep CVE-2014-16706.8The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a craft CVE-2014-16716.5Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated user CVE-2014-16724.0Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the CVE-2014-16735.0Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.CVE-2014-16777.5Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.CVE-2014-16794.3Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-CVE-2014-16806.9Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll fi CVE-2014-168110.0Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security f CVE-2014-16824.0The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary u CVE-2014-16836.8The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid pa CVE-2014-16844.3The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allow