CVE-2016-9465

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2	Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2

References

https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0Issue Tracking, Patch, Third Party Advisory
https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58eIssue Tracking, Patch, Third Party Advisory
https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845Issue Tracking, Patch, Third Party Advisory
https://hackerone.com/reports/163338Exploit, Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2016-008Patch, Vendor Advisory
https://owncloud.org/security/advisory/?id=oc-sa-2016-018Patch, Vendor Advisory
https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0Issue Tracking, Patch, Third Party Advisory
https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58eIssue Tracking, Patch, Third Party Advisory
https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845Issue Tracking, Patch, Third Party Advisory
https://hackerone.com/reports/163338Exploit, Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2016-008Patch, Vendor Advisory
https://owncloud.org/security/advisory/?id=oc-sa-2016-018Patch, Vendor Advisory

Timeline

Published: Mar 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-94666.1Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery ap CVE-2016-94675.3Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The locati CVE-2016-94685.3Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exceptio CVE-2016-94698.2Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeReques CVE-2016-94709.0Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Re CVE-2016-94713.1Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a CVE-2016-94725.4Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected CVE-2016-94734.7Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to tr CVE-2016-94797.5The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted reques CVE-2016-94809.1libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed CVE-2016-94819.8In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The meth CVE-2016-94829.8Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator