CVE-2021-41180 Geolocation preview links can be set to arbitrary links in nextcloud talk

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only...

CVE-2021-41180 Geolocation preview links can be set to arbitrary links in nextcloud talk

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only...

CVE-2021-41180

CVE-2021-41180 affects Nextcloud Talk: geolocation preview links can be set to arbitrary URLs due to insufficient validation, enabling an open-redirect scenario. Reported impact is limited to Android Talk clients, with the recommended mitigation being upgrading the Nextcloud Talk app to version 1...

CVE-2021-41256

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally...

CVE-2021-41256

CVE-2021-41256 affects the Nextcloud News for Android client. A local attacker on the same device can craft an Intent that is reflected back, enabling read/write access to non-exported Content Providers. Affected users should upgrade to Nextcloud News for Android 0.9.9.63 or higher. The CVE entry...

CVE-2021-41256 Intent URI permissions manipulation in nextcloud news-android

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally...

CVE-2021-23155

Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Client for Android 8.60 versions prior to 8.60.065; version 8.50 and prior versions...

Nextcloud Trust Management Issues Vulnerability (CNVD-2021-51798)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. The Nextcloud Android Client prior to version 3.16.1 is vulnerable to a trust management issue that stems from the Nextcloud Android Client skipping a step th...

CVE-2021-32727

Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private...

CVE-2021-32727 End-to-end encryption device setup did not verify public key

Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private...

Nextcloud 信任管理问题漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. The Nextcloud Android Client prior to version 3.16.1 is vulnerable to a trust management issue that stems from the Nextcloud Android Client skipping a step th...

CVE-2021-32727: Improper Certificate Validation

Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private...

Code injection

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1...

CVE-2021-32694 Malicious Android application can crash the Nextcloud Android Client

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1...

PT-2021-19861

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.15.1 Description The issue allows a malicious application on the same device to crash the Nextcloud Android Client due to an uncaught exception. Recommendations For versions prior to 3.15.1, update to...

CVE-2021-32658

Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that...

Code injection

Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that...

Sensitive data may not be removed from storage on account removal

None...

Windows Remote Desktop Protocol Security Vulnerability

Microsoft Windows Remote Desktop Protocol RDP is an application for connecting to remote Windows desktops from Microsoft USA. A security vulnerability exists in Windows Remote Desktop Protocol. The following products and versions are affected:Microsoft Remote Desktop,Remote Desktop client for...

SQL Injection Vulnerability in OneKey Education Cloud Disk Service Platform of Orient Boguan (Beijing) Technology Co.

The OneKey Education Cloud Disk Service Platform supports multiple platforms such as Web, PC, and Android cell phone clients for cross-platform and cross-terminal file sharing and anytime, anywhere access. There is a SQL injection vulnerability in the OneKey Education Cloud Disk Service Platform ...