CVE-2016-9459

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.

• CWE-209
• CWE-79

• http://www.securityfocus.com/bid/97284Third Party Advisory, VDB Entry
• https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070Issue Tracking, Patch, Third Party Advisory
• https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335Issue Tracking, Patch, Third Party Advisory
• https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1Issue Tracking, Patch, Third Party Advisory
• https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dcIssue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/146278Exploit, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-002Patch, Vendor Advisory
• https://owncloud.org/security/advisory?id=oc-sa-2016-012Patch, Vendor Advisory
• http://www.securityfocus.com/bid/97284Third Party Advisory, VDB Entry
• https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070Issue Tracking, Patch, Third Party Advisory
• https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335Issue Tracking, Patch, Third Party Advisory
• https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1Issue Tracking, Patch, Third Party Advisory
• https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dcIssue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/146278Exploit, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-002Patch, Vendor Advisory
• https://owncloud.org/security/advisory?id=oc-sa-2016-012Patch, Vendor Advisory

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9453The t2p_readwrite_pdf_image_tile function in LibTIFF allows …7.8
• CVE-2016-9454Revive Adserver before 3.2.3 suffers from Persistent XSS. A …
• CVE-2016-9455Revive Adserver before 3.2.3 suffers from Cross-Site Request…
• CVE-2016-9456Revive Adserver before 3.2.3 suffers from Cross-Site Request…
• CVE-2016-9457Revive Adserver before 3.2.3 suffers from Reflected XSS. `ww…
• CVE-2016-9458Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9460Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.…
• CVE-2016-9461Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.…
• CVE-2016-9462Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.…
• CVE-2016-9463Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server …
• CVE-2016-9464Nextcloud Server before 9.0.54 and 10.0.0 suffers from an im…
• CVE-2016-9465Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.…