ID de Prueba:	1.3.6.1.4.1.25623.1.0.804660
Categoría:	Web application abuses
Título:	ownCloud Multiple Vulnerabilities (oC-SA-2013-014, oC-SA-2013-015)
Resumen:	ownCloud is prone to multiple vulnerabilities.
Descripción:	Summary: ownCloud is prone to multiple vulnerabilities. Vulnerability Insight: - CVE-2013-1941: Due to using 'time()' as random source in the ownCloud installation routine, the entropy of the generated PostgreSQL database user password is very low and can be easily guessed. This issue is inside the ownCloud setup routine and is not related to any PostgreSQL vulnerability. - CVE-2013-1942: A cross-site scripting (XSS) vulnerability allows remote attackers to execute arbitrary javascript when a user opens a special crafted URL. This vulnerability exists in the bundled 3rdparty plugin 'jPlayer', 'jPlayer' released version 2.2.20 which addresses the problem. Affected Software/OS: ownCloud 4.0.x through 4.0.13, 4.5.x through 4.5.8 and 5.0.x through 5.0.3. Solution: Update to version 4.0.14, 4.5.9, 5.0.4 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1941 Common Vulnerability Exposure (CVE) ID: CVE-2013-1942 20130421 Vulnerabilities in jPlayer http://seclists.org/fulldisclosure/2013/Apr/192 59030 http://www.securityfocus.com/bid/59030 [oss-security] 20130411 CVE-2013-1942 jPlayer 2.2.19 XSS http://marc.info/?l=oss-security&m=136570964825921&w=2 [oss-security] 20130429 Re: CVE-2013-1942 jPlayer 2.2.19 XSS http://marc.info/?l=oss-security&m=136726705917858&w=2 [oss-security] 20130505 Re: CVE-2013-1942 jPlayer 2.2.19 XSS http://marc.info/?l=oss-security&m=136773622321563&w=2 http://owncloud.org/about/security/advisories/oC-SA-2013-014/ http://www.jplayer.org/2.3.0/release-notes/ https://github.com/happyworm/jPlayer/commit/e8ca190f7f972a6a421cb95f09e138720e40ed6d
Copyright	Copyright (C) 2014 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.