Nextcloud: Any (non-admin) user from an instance can destroy any (user and/or global) external filesystem

A vulnerability in Nextcloud allowed any user on an instance to delete any external filesystem, regardless of ownership or type. This could be exploited by sending a DELETE request to the appropriate endpoint, resulting in the removal of the external storage from the system. The issue has been...

CVE-2023-35928 Nextcloud user scoped external storage can be used to gather credentials of other users

Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until...

PT-2023-3557 · Nextcloud +2 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.7 Nextcloud Server versions 26.0.0 through 26.0.2 Nextcloud Enterprise Server versions 19.0.0 through 19.0.13.9 Nextcloud Enterprise Server versions 20.0.0 through 20.0.14.14 Nextcloud Enterprise...

Nextcloud Server 25.x < 25.0.7, 26.x < 26.0.2 Multiple Vulnerabilities (GHSA-qphh-6xh7-vffg, GHSA-mjf5-p765-qmr6, GHSA-h7f7-535f-7q87, GHSA-637g-xp2c-qh5h)

Nextcloud Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextcloud:nextcloudserver"...

User scoped external storage can be used to gather credentials of other users

None...

CVE-2023-33188

Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated,...

Design/Logic Flaw

Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated,...

CVE-2023-33188 Uncontrolled data used in content resolution

Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated,...

CVE-2023-33188 Uncontrolled data used in content resolution

Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated,...

CVE-2023-33188 Uncontrolled data used in content resolution

Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated,...

Omni-Notes 安全漏洞

Omni-Notes is an open source notes application for Android. A security vulnerability exists in versions prior to Omni-Notes 6.2.7 that stems from the path to a note attachment not being properly validated, allowing a malicious or compromised application on the same device to cause Omni-notes to...

PT-2023-24205 · Unknown · Omni-Notes

Name of the Vulnerable Software and Affected Versions: Omni-notes versions prior to 6.2.7 Description: The Omni-notes Android app has an issue with insufficient path validation when displaying note details received through an externally-provided intent. This allows malicious applications on the...

Nextcloud: User scoped external storage can be used to gather credentials of other users

Vulnerability description not provided...

CVE-2022-39043

Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts...

CVE-2022-39043

Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts...

Information disclosure

Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts...

CVE-2022-39043 Juiker app - Information Leakage

Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts...

CVE-2022-39043 Juiker app - Information Leakage

Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts...

PT-2023-13676 · Unknown · Juiker App

Name of the Vulnerable Software and Affected Versions: Juiker app affected versions not specified Description: The issue concerns the storage of debug logs by the Juiker app, which includes sensitive information such as personal contacts, to the mobile device's external storage. This allows an...

Juiker 信息泄露漏洞

Juiker is an instant messaging software for government and enterprise organizations from Juiker. An information disclosure vulnerability exists in Juiker version 4.6.0607.1, which originates from storing debug logs containing sensitive information to removable external storage. An attacker could...