Cross site scripting

useroidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this endpoint. Additionally this...

UBUNTU-CVE-2022-39331

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue...

UBUNTU-CVE-2022-39334

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...

Code injection

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...

CVE-2022-39331

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue...

Nextcloud: Messages can still be seen on conversation after expiring when cron is misconfigured

A vulnerability in Nextcloud Talk allowed expired chat messages to still be visible to anyone with access to the conversation, even after the message expiration time had passed...

Nextcloud: OAuth2 "authorization_code" is valid indefinetly

A security advisory reported that the OAuth2 endpoint was not following best practices, as the authorization code was generated without a timeout, allowing an attacker with access to obtain and redeem the code in the future...

nextcloudcmd incorrectly trusts bad TLS certificates

None...

XSS in Desktop Client in call notification popup

None...

XSS in Desktop Client via user status and information

None...

XSS in Desktop Client in the notifications

None...

Cleartext Transmission of Sensitive Information in user_oidc

None...

Missing length validation of user displayname allows to generate an SQL error

None...

Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate

None...

CVE-2022-41926

CVE-2022-41926 concerns the Nextcloud Talk Android app. The receiver component is not protected by broadcastPermission in affected versions, enabling a malicious app to monitor communication locally. The issue is tied to Nextcloud Talk Android prior to 14.1.0. Remediation in all sources is to upg...

Nextcloud 信任管理问题漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A trust management issue vulnerability exists in versions of Nextcloud desktop prior to 3.6.1, which stems from the possibility of incorrectly trusting invalid TLS...

CVE-2022-41926 Nextcloud Talk Android broadcast incorrect permission handling

Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk Android is upgraded to 14.1.0. There are...

CVE-2022-39333

CVE-2022-39333 affects the Nextcloud Desktop Client. An attacker can inject arbitrary HTML into the Desktop Client application, enabling potential HTML/JS injection via the UI. Affected software: Nextcloud Desktop client prior to upgrade. Mitigation: upgrade to Nextcloud Desktop version 3.6.1 or ...

Nextcloud 跨站脚本漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A cross-site scripting vulnerability exists in Nexcloud desktop versions prior to 3.6.1, which originates from an attacker being able to inject arbitrary...

CVE-2022-39331 Cross-site Scripting (XSS) in Nexcloud Desktop Client

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue...