CVE-2014-9048

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://owncloud.org/security/advisory/?id=oc-sa-2014-024Vendor Advisory
https://owncloud.org/security/advisory/?id=oc-sa-2014-024Vendor Advisory

Timeline

Published: Feb 4, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-90494.0The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid ses CVE-2014-90505.0Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of CVE-2014-90577.5SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote at CVE-2014-90594.3lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information CVE-2014-90605.0The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the param CVE-2014-90654.4common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a deni CVE-2014-90664.7Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users CVE-2014-90877.5Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of se CVE-2014-90897.5Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL co CVE-2014-90904.9The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with t CVE-2014-90914.6Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain p CVE-2014-90926.5libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.