CVE-2020-8281

A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting XSS attacks...

Cross site scripting

A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting XSS attacks...

CVE-2020-8280

CVE-2020-8280 — Nextcloud Contacts 3.4.0 suffers from a missing file type check that lets an attacker upload SVG files with a PNG extension to trigger cross-site scripting (XSS) when viewing a contact image. The issue is documented across multiple feeds (NVD/NSS, CNVD, Red Hat, OSV, CNVD) and is ...

CVE-2020-8280

A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting XSS attacks...

CVE-2020-8281

Nextcloud Contacts 3.3.0 is affected by a missing file type check that allows uploading SVG files, enabling cross-site scripting (XSS). The issue is documented in the Nextcloud advisory NC-SA-2020-045 and corroborated by CNVD/NVD entries and a related HackerOne report, indicating practical XSS vi...

Nextcloud 跨站脚本漏洞

Nextcloud Contacts is the user interface for Nextcloud's CardDAV server. A cross-site scripting vulnerability exists in Nextcloud Contacts 3.4.0. The vulnerability stems from a missing file type check. The vulnerability can be exploited to conduct cross-site scripting attacks by uploading SVG fil...

XSS through image upload of contacts using svg file (NC-SA-2020-045)

A missing file type check in Nextcloud Contacts 3.3.0 allowed a malicious user to upload malicious SVG files to perform XSS attacks...

XSS through image upload on contacts using svg file with png extension (NC-SA-2020-044)

A missing file type check in Nextcloud Contacts 3.4.0 allowed a malicious user to upload SVG files as PNG files to perform XSS attacks...

Nextcloud Contacts Code Issue Vulnerability

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Contacts is one of the contact information synchronization and editing applications. A security vulnerability in Nextcloud Contacts version 3.2.0 exists du...

CVE-2020-8181

A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...

CVE-2020-8181

A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...

Design/Logic Flaw

A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...

CVE-2020-8181

A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...

Nextcloud Contacts Cross-Site Scripting Vulnerability

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication applications from Nextcloud Germany.Nextcloud Contacts is one of the applications used to synchronize and manage contacts. A cross-site scripting vulnerability exists in versions prior to Nextcloud...

Cross site scripting

In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or...