Missing memory corruption protection on Windows release built (NC-SA-2020-035)

Missing ASLR and DEP protections in Nextcloud Desktop Client 2.6.4 for windows allowed to corrupt memory...

Nextcloud: Full path disclosure vulnerability via Upload .htaccess file

Hello Security team, i foud Full path disclosure vulnerability via Upload .htaccess file see POC video. Thankz Impact Sensitive File/Folder Information...

Nextcloud: Access control missing while viewing the attachments in the "All boards"

The vulnerability lies in the "view attachment" of the tasks . When a user uploads the file to the Task, the attachment is given a numeric number and is increased +1 on further uploads. It is easy for any user to view and download all the files uploaded to the tasks by any user. The access is not...

Nextcloud: Social App does not validate server certificates for outgoing connections

The Social App https://apps.nextcloud.com/apps/social does not validate the server TLS certificate for connections to other ActivityPub servers. These connections are used to retrieve the public key for a user or posting a message to another ActivityPub server. The public key for a user is used t...

Nextcloud Deck Access Control Error Vulnerability

Nextcloud Deck is a Kanban-style organization tool developed by Nextcloud, Inc. designed for individual planning and project organization for teams integrated with Nextcloud. An access control vulnerability exists in Nextcloud Deck version 1.0.0. An attacker can exploit the vulnerability to injec...

CVE-2020-8179

Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...

CVE-2020-8179

Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...

Improper access control

Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...

CVE-2020-8179

CVE-2020-8179 affects Nextcloud Deck 1.0.0. The root cause is an improper access control in the deck task/move flow: updating a card’s stackId via /apps/deck/cards/{id} does not enforce that the destination belongs to the requester, allowing an attacker to inject tasks into another user’s deck. T...

CVE-2020-8179

Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...

Nextcloud: Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki

Github wikis on the following projects https://github.com/nextcloud/bookmarks/wiki can be edited by any logged in user in the system. This poses security and reputation risk for the company. Impact As wikis listed above can be edited by any person on the internet, a malicious actor can accurately...

nextcloud.com Improper Access Control vulnerability OBB-1202341

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Nextcloud: SSL certificate not validated when registering with a provider

Description When running the desktop client for the first time, users can click the "Register with a provider" button to sign up for a Nextcloud account with a Nextcloud cloud provider. Clicking "Register..." opens a web page in a Nextcloud desktop client window with content from...

PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...

Nextcloud: Reflected XSS when renaming a file with a vulnerable name which results in an error

Hi, It looks like Nextcloud team will accept the XSS protected by the CSP. Report 896511 Here is another XSS. 1. Rename an existing filename to .jpg. 2. Anyone tries to rename this .jpg with an invalid filename, like add a "" in it, will trigger the XSS attack. 3. Need bypass the CSP. Thanks...

Nextcloud: XSS in image metadata field

Hi, Will you confirm the XSS vulnerability blocked by the CSP? On Nextcloud 19.0.0 1. Upload the PoC.jpg 2. Check the PoC.jpg metadata 3. Need bypass the CSP to trigger it Impact Cross-Site Scripting...

Nextcloud: Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers

In two Nextclouds A and B, in settings/admin/sharing, these settings are enabled: Restrict users to only share with users in their groups Restrict username autocompletion to users within the same groups Add server automatically once a federated share was created successfully Some user on A now...

Nextcloud: XSS through image upload of contacts using svg file

This is a bypass of report 808287 Upload the attached file for the image of a contact, right click "Open image in new tab" and you will see the xss. Impact The person viewing the image of a contact can be victim of XSS...

Nextcloud Talk Code Injection Vulnerability

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. A code injection vulnerability exists in Nextcloud Talk versions 6.0.4, 7.0.2, and 8.0.7, which stems from the program failing to properly clean up Talk commands. An attacker could exploit the...

CVE-2020-8180

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...