385 matches found
CVE-2024-52518 Nextcloud Server is missing password confirmation when changing external storage options
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...
CVE-2024-52518 Nextcloud Server is missing password confirmation when changing external storage options
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...
CVE-2024-52523
CVE-2024-52523 affects Nextcloud Server. When a user or administrator defines external storage with fixed credentials, the API returns those credentials and re-inserts them into the frontend, allowing an attacker with an active user session to read them in plain text. The vulnerability enables in...
CVE-2024-52523 Nextcloud Server Custom defined credentials of external storages are sent back to the frontend
Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...
Custom defined credentials of external storages are sent back to the frontend
None...
Nextcloud 授权问题漏洞
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an authorization issue vulnerability that originates when an attacker gains access to a user or administrator session to create, change...
Nextcloud 信息泄露漏洞
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an information disclosure vulnerability that stems from the fact that after setting up user- or administrator-defined external storage...
CVE-2024-11136
The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage...
CVE-2024-11136 Arbitrary file removal via path traversal in TCL Camera
The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage...
CVE-2024-11136 Arbitrary file removal via path traversal in TCL Camera
The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage...
CVE-2024-11136
The CVE-2024-11136 entry concerns the default TCL Camera application, which exposes a provider vulnerable to path traversal. A malicious app can supply a crafted URI path through this provider to delete arbitrary files on the user’s external storage. The vulnerability is rooted in the provider’s ...
PT-2024-16782 · Tcl · Tcl Camera
Name of the Vulnerable Software and Affected Versions: TCL products affected versions not specified Description: The default TCL Camera application has a path traversal vulnerability in its provider. A malicious application can supply a malicious URI path, allowing it to delete arbitrary files fr...
CVE-2024-43093
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User...
VulnCheck KEV: CVE-2022-45440
A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17ABPC.3C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a...
PT-2024-9160 · Nextcloud +2 · Nextcloud Enterprise Server +3
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.12 Nextcloud Server versions prior to 29.0.9 Nextcloud Server versions prior to 30.0.2 Nextcloud Enterprise Server versions prior to 25.0.13.14 Nextcloud Enterprise Server versions prior to 26.0.13.10...
CVE-2024-47222
New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI protocol...
RHSA-2019:4054 Red Hat Security Advisory: OpenShift Container Platform 3.11 openshift-external-storage security update
Bulletin has no description...
RHSA-2019:4096 Red Hat Security Advisory: OpenShift Container Platform 4.2 openshift-external-storage security update
Bulletin has no description...
Insecure Direct Object Reference in external storage - ownCloud
Insecure Direct Object Reference in external storage configuration may allow an authenticated attacker to change configuration of external storage of another user as well as gain access to credentials...