{"id":"CVE-2016-1498","aliases":["EUVD-2016-2596","GHSA-vjwh-5g7w-qqh8","MGASA-2016-0040"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud...","description":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01089,"percentile":0.65552,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2016-01-08T21:00:00Z","modified":"2026-10-24T10:30:29Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"owncloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-1.mga5"}]}],"bundled":3}],"products":[{"vendor":"owncloud","product":"owncloud"},{"vendor":"owncloud","product":"owncloud_server"}],"references":[{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-001","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1498"},{"url":"https://github.com/advisories/GHSA-vjwh-5g7w-qqh8"},{"url":"https://advisories.mageia.org/MGASA-2016-0040.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17620","tags":["report"]},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-002","tags":["advisory"]},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-003","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2016-January/176017.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-1498","description":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.","status":"published","published":"2016-01-08T21:00:00Z","modified":"2024-08-05T22:55:14.84Z","updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-2596","description":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.","status":"published","published":"2016-01-08T21:00:00Z","modified":"2024-08-05T22:55:14Z","updated_at":"2026-11-03T02:22:56.986033Z"}],"ghsa":[{"id":"GHSA-vjwh-5g7w-qqh8","title":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud...","description":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.","status":"published","published":"2022-05-17T03:59:52Z","modified":"2023-01-28T05:00:55Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:26.967621Z"}],"nvd":[{"id":"CVE-2016-1498","description":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.","status":"published","published":"2016-01-08T21:59:06.937Z","modified":"2026-06-17T00:42:05.097Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:21.143462Z"}],"osv":[{"id":"CVE-2016-1498","description":"Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.","status":"published","published":"2016-01-08T21:59:06.937Z","modified":"2026-10-24T10:30:29.478002579Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"MGASA-2016-0040","title":"Updated owncloud packages fix security vulnerability","description":"A Cross-site scripting (XSS) vulnerability in the OCS discovery provider\nin ownCloud Server before 8.0.10 allows remote attackers to inject\narbitrary web script or HTML via the URL resulting in a reflected\nCross-Site-Scripting (CVE-2016-1498).\n\nownCloud Server before 8.0.10 allows remote authenticated users to obtain\nsensitive information from a directory listing and possibly cause a denial\nof service (CPU consumption) via the force parameter to\nindex.php/apps/files/ajax/scan.php (CVE-2015-1499).\n\nownCloud Server before 8.0.10, when the \"file_versions\" application is\nenabled, does not properly check the return value of getOwner, which\nallows remote authenticated users to read the files with names starting\nwith \".v\" and belonging to a sharing user by leveraging an incoming share\n(CVE-2016-1500).\n","status":"published","published":"2016-01-29T11:02:50Z","modified":"2026-04-16T06:24:35.576997424Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}