1617 matches found
nextcloud-ldap-put-isadmin
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-ldap-put-isadmin Write-up: https://abraxaslabs.tech/research/nextcloud-ldap-put-isadmin nextcloud-ldap-put-isadmin Nextcloud Server 35.0.0 - Nextcloud GmbH PUT /cloud/users/id lets a delegated Users admin...
nextcloud-federated-ocm-token
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-federated-ocm-token Write-up: https://abraxaslabs.tech/research/nextcloud-federated-ocm-token nextcloud-federated-ocm-token Nextcloud Server 35.0.0 - Nextcloud GmbH A federated share secret is minted as an...
PoC---CVE-2023-26482-RCE-LAB-Nextcloud
Next cloud Proof of Concept & Analysis Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...
nextcloud-calendar-sharee-publish
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-calendar-sharee-publish Write-up: https://abraxaslabs.tech/research/nextcloud-calendar-sharee-publish nextcloud-calendar-sharee-publish Nextcloud Server 35.0.0 - Nextcloud GmbH CalDAV PublishPlugin only...
CVE-2026-82984
A flaw was found in Nextcloud Server. When a team is configured as visible to all users, the web interface restricts access to non-members, but the underlying resources application programming interface API endpoint fails to enforce proper access controls. An authenticated user who is not a team...
CVE-2026-77172
A flaw was found in Nextcloud Server. Application passwords were permitted to bypass password confirmation on sensitive endpoints. An attacker with access to a valid application password could perform operations on sensitive endpoints that normally require re-confirmation of the account password,...
nextcloud-webhook-tokenneeded
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-webhook-tokenneeded Write-up: https://abraxaslabs.tech/research/nextcloud-webhook-tokenneeded nextcloud-webhook-tokenneeded Nextcloud Server 35.0.0 - Nextcloud GmbH WebhooksController::create nulls...
CVE-2026-118664 vulnerabilities
Vulnerabilities for packages: nextcloud-server, opensearch-dashboards, vitess...
GHSA-QR28-FPJM-WQ7F vulnerabilities
Vulnerabilities for packages: nextcloud-server, opensearch-dashboards, vitess...
GHSA-R925-MGVR-H9CC vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-108082 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
Nextcloud Server permission and access control issue vulnerability
Versions 32.0.0 through 33.0.0 of Nextcloud Server contain a vulnerability related to permission and access control. This issue arises because the resources API endpoint fails to properly restrict access for non-members; as a result, authenticated non-members can directly invoke this endpoint to...
Nextcloud Server resource management error vulnerability
A resource management error vulnerability exists in Nextcloud Server versions 22.0.0 through 34.0.0. This vulnerability arises because the federated sharing endpoint can write arbitrary rows to the ocshareexternal database table without any automatic cleanup mechanism, potentially leading to a...
Nextcloud Server permission and access control issue vulnerability
Versions 32.0.0 through 34.0.0 of Nextcloud Server contain a vulnerability related to permission escalation and access control. This issue arises because application passwords can bypass password validation at sensitive endpoints, potentially leading to improper permission management...
GHSA-C6GR-QVV4-5V3F vulnerabilities
Vulnerabilities for packages: awx, opensearch-dashboards, nextcloud-server, gitlab-rails-ce, langfuse, librechat, supabase, opensearch-dashboards-fips, langfuse-fips, gitlab-rails-ce-fips, wazuh-dashboard-fips, wazuh-dashboard...
GHSA-CG2G-XH64-V4Q7 vulnerabilities
Vulnerabilities for packages: awx, opensearch-dashboards, nextcloud-server, gitlab-rails-ce, langfuse, librechat, supabase, opensearch-dashboards-fips, langfuse-fips, gitlab-rails-ce-fips, wazuh-dashboard-fips, wazuh-dashboard...
GHSA-MRV2-3PQR-J5JR vulnerabilities
Vulnerabilities for packages: awx, opensearch-dashboards, nextcloud-server, gitlab-rails-ce, langfuse, librechat, supabase, opensearch-dashboards-fips, langfuse-fips, gitlab-rails-ce-fips, wazuh-dashboard-fips, wazuh-dashboard...
GHSA-9JRQ-W75R-8GCW vulnerabilities
Vulnerabilities for packages: nextcloud-server, gitlab-rails-ce, langfuse, langfuse-fips, gitlab-rails-ce-fips, kubeflow-pipelines...