CVE-2024-1888 Existing server guests invited to the team by members without "invite_guest" permission

Mattermost fails to check the "inviteguest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server...

CVE-2024-1888 Existing server guests invited to the team by members without "invite_guest" permission

Mattermost fails to check the "inviteguest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server...

x86: shadow stack vs exceptions from emulation stubs

ISSUE DESCRIPTION Recent x86 CPUs offer functionality named Control-flow Enforcement Technology CET. A sub-feature of this are Shadow Stacks CET-SS. CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and...

Ubuntu 23.10 : Linux kernel (Azure) vulnerabilities (USN-6652-1)

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6652-1 advisory. Marek Marczykowski-Grecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in ...

SUSE CVE-2023-31346

Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests...

CVE-2023-31346

Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests...

CVE-2023-31346

Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests...

CVE-2024-22401

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or...

CVE-2024-22402

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

Authentication flaw

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22402 Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22402 Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22402

CVE-2024-22402 concerns the Nextcloud Guests app. The issue is an improper handling of request URLs that lets guest users load pages of apps they should not access, effectively bypassing the app allowlist. Affected Nextcloud Guests versions include 2.4.x, 2.5.x, and 3.0.x (with mitigation guidanc...

CVE-2024-22402 Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22401

The CVE-2024-22401 issue affects the Nextcloud Guests app, where non-admin users could alter the allowed-list of apps, enabling use of unintended apps. Affected Nextcloud Guests versions include prior to 2.4.1, prior to 2.5.1, and prior to 3.0.1. Upgrades to 2.4.1, 2.5.1, or 3.0.1 are recommended...

CVE-2024-22401 All users can reset the allowed apps list for Nextcloud Guest App users

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or...

Improper handling of request URLs in Guests app allows guest users to bypass app allowlist

None...

PT-2024-19392 · Nextcloud · Nextcloud Guests App

Name of the Vulnerable Software and Affected Versions: Nextcloud Guests app versions prior to 2.4.1 Nextcloud Guests app versions prior to 2.5.1 Nextcloud Guests app versions prior to 3.0.1 Description: The Nextcloud guests app is a utility to create guest users which can only see files shared wi...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud guests that stems from the ability for all users to reset the application list for guest users. Affected...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from improper handling of request URLs, which allows users to load unallowed application pages...