CVE-2019-5455

CVE-2019-5455 affects the Nextcloud Android app (v3.6.0). The issue allows bypassing the device lock protection during multi-account creation/abort, enabling the attacker to redirect to a default account without prompting for the lock pattern. Evidence includes a PoC described in the HackerOne re...

CVE-2019-5455

Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process...

PT-2019-17682

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.3.0 Description The issue allows bypassing lock protection, enabling access to files when prompted for lock protection and switching to the Nextcloud file provider. Recommendations For versions prior t...

PT-2019-17681

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.6.2 Description The issue allows bypassing lock protection, resulting in the leaking of thumbnails when requesting the Android content provider, even when the lock protection was not solved...

PT-2019-17679

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.7.0 Description The issue concerns improper sanitization of HTML in directory names. This allows styling of the directory name in the header bar when using basic HTML. Recommendations For versions prio...

PT-2019-17684 · Nextcloud · Nextcloud Android App

Name of the Vulnerable Software and Affected Versions: Nextcloud Android app version 3.6.0 Description: The issue allows bypassing lock protection when creating a multi-account and aborting the process in the Nextcloud Android app. Recommendations: For Nextcloud Android app version 3.6.0, update ...

PT-2019-17683 · Nextcloud · Nextcloud Android App

Name of the Vulnerable Software and Affected Versions: Nextcloud Android app versions prior to 3.0.0 Description: The issue allows for the destruction of a local cache when a harmful query is executed, requiring the user to reset up the account. This occurs due to SQL Injection in the Nextcloud...

PT-2019-17680

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.6.1 Description The issue allows bypassing lock protection by repeatedly opening and closing the app in a short time, enabling access to files. Recommendations For versions prior to 3.6.1, update to...

CVE-2019-5454: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account...

CVE-2019-5453: Authentication Bypass Using an Alternate Path or Channel

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider...

CVE-2019-5452: Improper Access Control

Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved...

CVE-2019-5455: Authentication Bypass Using an Alternate Path or Channel

Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process...

CVE-2019-5451: Authentication Bypass Using an Alternate Path or Channel

Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time...

CVE-2019-11730

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and...

CVE-2019-13097

The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server...

CVE-2019-13097

The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server...

CVE-2019-13097

The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server...

CVE-2019-13100

The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system i.e., in cleartext, which allows a non-root user to find out the username/password of a valid user via /data/data/com.estmob.android.sendanywhere/sharedprefs/sendanywheredevice.xml...

CVE-2019-11730

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and...

CVE-2019-5961

The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...